chore: Update version

The OIDC implementation merged in https://github.com/plankanban/planka/pull/491 is flawed for multiple reasons.

It assumes that the access_token returned by the IDP has to be a JWT parseable by the RP which is not the case [1].
Many major IDPs do issue tokens which are not JWTs and RPs should not rely on the contents of these at all.
The only signed token which has a standardized format for direct RP consumption is the OIDC ID token (id_token), but this by default doesn't contain many claims, especially role claims are omitted from them by default for size reasons. To get these additional claims into the ID token, one needs an IDP with support for the "claims" parameter.

It requires manual specification of the JWKS URL which is mandatory in any OIDC discovery document and thus never needs to be manually specified.

It also makes the questionable decision to use a client-side code flow with PKCE where a normal code flow would be much more appropriate as all user data is processed in the backend which can securely hold a client secret (confidential client). This has far wider IDP support, is safer (due to direct involvement of the IDP in obtaining user information) and doesn't require working with ID tokens and claim parameters.

By using a server-side code flow we can also offload most complexity to the server alone, no longer requiring an additional OIDC library on the web client.

Also silent logout doesn't work on most IDPs for security reasons, one needs to actually redirect the user over to the IDP, which then prompts them once more if they actually want to log out.

This implementation should work with any OIDC-compliant IDP and even OAuth 2.0-only IDPs as long as they serve and OIDC discovery document.

[1] rfc-editor.org/rfc/rfc6749#section-5.1

.github/workflows/build-and push release-package.yml

@@ -0,0 +1,57 @@
+name: Build and publish release package
+
+on:
+  release:
+    types: [created]
+
+
+jobs:
+  build-and-publish-release-package:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '18'
+          cache: 'npm'
+
+      - name: Workflow install pnpm
+        run: npm install pnpm -g
+
+      - name: Client install dependencies
+        run: pnpm install
+
+      - name: Server install dependencies
+        run: pnpm install
+
+      - name: Server include into dist
+        run: mv server/ dist/
+
+      - name: Client build production
+        run: |
+          npm run build
+        working-directory: ./client
+
+      - name: Client include into dist
+        run: |
+          mv build/index.html ../dist/views/index.ejs
+          mv build/* ../dist/public/
+        working-directory: ./client
+
+      - name: Dist include README.md SECURITY.md LICENSE start.sh
+        run: mv README.md SECURITY.md LICENSE start.sh dist/
+
+      - name: Dist Remove node modules
+        run: rm -R dist/node_modules
+
+      - name: Dist create .zip file
+        run: |
+          mv dist/ planka/
+          zip -r planka-prebuild-${{ github.event.release.tag_name }}.zip planka
+
+      - name: Dist upload assets
+        run: |
+          gh release upload ${{ github.event.release.tag_name }} planka-prebuild-${{ github.event.release.tag_name }}.zip
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/build-and-push-docker-base-image.yml

@@ -13,26 +13,26 @@ env:
 
 jobs:
   build-and-push-docker-base-image:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v4
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/arm/v7

.github/workflows/build-and-push-docker-image-dev.yml

@@ -0,0 +1,34 @@
+name: Build and push Docker DEV image
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  build-and-push-docker-image-dev:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          push: true
+          tags: |
+            ghcr.io/plankanban/planka:dev

.github/workflows/build-and-push-docker-image.yml

@@ -6,19 +6,19 @@ on:
 
 jobs:
   build-and-push-docker-image:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -32,7 +32,7 @@ jobs:
           script: return context.payload.release.tag_name.replace('v', '')
 
       - name: Build and push
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v4
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/arm/v7

.github/workflows/helm-chart-release.yml

@@ -13,10 +13,10 @@ jobs:
     # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
     permissions:
       contents: write
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 

Dockerfile

@@ -5,7 +5,8 @@ WORKDIR /app
 COPY server/package.json server/package-lock.json .
 
 RUN npm install npm@latest --global \
-  && npm clean-install --omit=dev
+  && npm install pnpm --global \
+  && pnpm install --prod
 
 FROM node:lts AS client
 
@@ -14,7 +15,8 @@ WORKDIR /app
 COPY client/package.json client/package-lock.json .
 
 RUN npm install npm@latest --global \
-  && npm clean-install --omit=dev
+  && npm install pnpm --global \
+  && pnpm install --prod
 
 COPY client .
 RUN DISABLE_ESLINT_PLUGIN=true npm run build

README.md

@@ -23,6 +23,7 @@
 There are 2 types of installation:
 - [Without Docker](https://docs.planka.cloud/docs/installl-planka/Debian%20&%20Ubuntu) ([for Windows](https://docs.planka.cloud/docs/installl-planka/Windows))
 - [Dockerized](https://docs.planka.cloud/docs/installl-planka/Docker%20Compose)
+- [Automated installation](https://github.com/plankanban/planka-installer)
 
 For configuration, please see the [configuration section](https://docs.planka.cloud/docs/category/configuration).
 

charts/planka/Chart.yaml

@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.1
+version: 0.1.6
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.12.0"
+appVersion: "1.14.1"
 
 dependencies:
   - alias: postgresql

charts/planka/templates/deployment.yaml

@@ -64,7 +64,9 @@ spec:
                   name: planka-postgresql-svcbind-custom-user
                   key: uri
             - name: BASE_URL
-              {{- if .Values.ingress.enabled }}
+              {{- if .Values.baseUrl }}
+              value: {{ .Values.baseUrl }}
+              {{- else if .Values.ingress.enabled }}
               value: {{ printf "https://%s" (first .Values.ingress.hosts).host }}
               {{- else }}
               value: http://localhost:3000
@@ -73,6 +75,10 @@ spec:
               value: {{ required "A secret key needs to be generated using 'openssl rand -hex 64' and assigned to secretkey." .Values.secretkey }}
             - name: TRUST_PROXY
               value: "0"
+          {{ range $k, $v := .Values.env }}
+            - name: {{ $k | quote }}
+              value: {{ $v | quote }}
+          {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/planka/values.yaml

@@ -17,6 +17,10 @@ fullnameOverride: ""
 # Generate a secret using openssl rand -base64 45
 secretkey: ""
 
+# Base url for Planka. Will override `ingress.hosts[0].host`
+# Defaults to `http://localhost:3000` if ingress is disabled.
+baseUrl: ""
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true
@@ -50,6 +54,7 @@ ingress:
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
   hosts:
+      # Used to set planka BASE_URL if no `baseurl` is provided.
     - host: planka.local
       paths:
         - path: /

client/.env

@@ -1 +1 @@
-REACT_APP_VERSION=1.12.0
+REACT_APP_VERSION=1.14.1

client/package-lock.json

@@ -18,6 +18,7 @@
         "js-cookie": "^3.0.1",
         "jwt-decode": "^3.1.2",
         "lodash": "^4.17.21",
+        "nanoid": "^5.0.2",
         "node-sass": "^8.0.0",
         "photoswipe": "^5.3.3",
         "prop-types": "^15.8.1",
@@ -16407,14 +16408,20 @@
       "integrity": "sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ=="
     },
     "node_modules/nanoid": {
-      "version": "3.3.4",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
-      "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw==",
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.0.2.tgz",
+      "integrity": "sha512-2ustYUX1R2rL/Br5B/FMhi8d5/QzvkJ912rBYxskcpu0myTHzSZfTr1LAS2Sm7jxRUObRrSBFoyzwAhL49aVSg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
       "bin": {
-        "nanoid": "bin/nanoid.cjs"
+        "nanoid": "bin/nanoid.js"
       },
       "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+        "node": "^18 || >=20"
       }
     },
     "node_modules/natural-compare": {
@@ -18658,6 +18665,23 @@
       "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
       "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ=="
     },
+    "node_modules/postcss/node_modules/nanoid": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
+      "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
@@ -35471,9 +35495,9 @@
       "integrity": "sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ=="
     },
     "nanoid": {
-      "version": "3.3.4",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
-      "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw=="
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.0.2.tgz",
+      "integrity": "sha512-2ustYUX1R2rL/Br5B/FMhi8d5/QzvkJ912rBYxskcpu0myTHzSZfTr1LAS2Sm7jxRUObRrSBFoyzwAhL49aVSg=="
     },
     "natural-compare": {
       "version": "1.4.0",
@@ -36252,6 +36276,13 @@
         "nanoid": "^3.3.4",
         "picocolors": "^1.0.0",
         "source-map-js": "^1.0.2"
+      },
+      "dependencies": {
+        "nanoid": {
+          "version": "3.3.6",
+          "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
+          "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA=="
+        }
       }
     },
     "postcss-attribute-case-insensitive": {

client/package.json

@@ -65,6 +65,7 @@
     "js-cookie": "^3.0.1",
     "jwt-decode": "^3.1.2",
     "lodash": "^4.17.21",
+    "nanoid": "^5.0.2",
     "node-sass": "^8.0.0",
     "photoswipe": "^5.3.3",
     "prop-types": "^15.8.1",

client/src/actions/core.js

@@ -1,6 +1,7 @@
 import ActionTypes from '../constants/ActionTypes';
 
 const initializeCore = (
+  config,
   user,
   board,
   users,
@@ -20,6 +21,7 @@ const initializeCore = (
 ) => ({
   type: ActionTypes.CORE_INITIALIZE,
   payload: {
+    config,
     user,
     board,
     users,

client/src/actions/login.js

@@ -1,5 +1,12 @@
 import ActionTypes from '../constants/ActionTypes';
 
+const initializeLogin = (config) => ({
+  type: ActionTypes.LOGIN_INITIALIZE,
+  payload: {
+    config,
+  },
+});
+
 const authenticate = (data) => ({
   type: ActionTypes.AUTHENTICATE,
   payload: {
@@ -21,12 +28,33 @@ authenticate.failure = (error) => ({
   },
 });
 
+const authenticateUsingOidc = () => ({
+  type: ActionTypes.USING_OIDC_AUTHENTICATE,
+  payload: {},
+});
+
+authenticateUsingOidc.success = (accessToken) => ({
+  type: ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS,
+  payload: {
+    accessToken,
+  },
+});
+
+authenticateUsingOidc.failure = (error) => ({
+  type: ActionTypes.USING_OIDC_AUTHENTICATE__FAILURE,
+  payload: {
+    error,
+  },
+});
+
 const clearAuthenticateError = () => ({
   type: ActionTypes.AUTHENTICATE_ERROR_CLEAR,
   payload: {},
 });
 
 export default {
+  initializeLogin,
   authenticate,
+  authenticateUsingOidc,
   clearAuthenticateError,
 };

client/src/api/access-tokens.js

@@ -5,10 +5,14 @@ import socket from './socket';
 
 const createAccessToken = (data, headers) => http.post('/access-tokens', data, headers);
 
+const exchangeForAccessTokenUsingOidc = (data, headers) =>
+  http.post('/access-tokens/exchange-using-oidc', data, headers);
+
 const deleteCurrentAccessToken = (headers) =>
   socket.delete('/access-tokens/me', undefined, headers);
 
 export default {
   createAccessToken,
+  exchangeForAccessTokenUsingOidc,
   deleteCurrentAccessToken,
 };

client/src/api/http.js

@@ -5,9 +5,11 @@ import Config from '../constants/Config';
 const http = {};
 
 // TODO: add all methods
-['POST'].forEach((method) => {
+['GET', 'POST'].forEach((method) => {
   http[method.toLowerCase()] = (url, data, headers) => {
-    const formData = Object.keys(data).reduce((result, key) => {
+    const formData =
+      data &&
+      Object.keys(data).reduce((result, key) => {
         result.append(key, data[key]);
 
         return result;

client/src/api/index.js

@@ -1,5 +1,6 @@
 import http from './http';
 import socket from './socket';
+import root from './root';
 import accessTokens from './access-tokens';
 import users from './users';
 import projects from './projects';
@@ -20,6 +21,7 @@ import notifications from './notifications';
 export { http, socket };
 
 export default {
+  ...root,
   ...accessTokens,
   ...users,
   ...projects,

client/src/api/root.js

@@ -0,0 +1,9 @@
+import http from './http';
+
+/* Actions */
+
+const getConfig = (headers) => http.get('/config', undefined, headers);
+
+export default {
+  getConfig,
+};

client/src/components/CardModal/Activities/CommentEdit.jsx

@@ -5,7 +5,7 @@ import { useTranslation } from 'react-i18next';
 import TextareaAutosize from 'react-textarea-autosize';
 import { Button, Form, TextArea } from 'semantic-ui-react';
 
-import { useClosableForm, useForm } from '../../../hooks';
+import { useForm } from '../../../hooks';
 
 import styles from './CommentEdit.module.scss';
 
@@ -35,12 +35,7 @@ const CommentEdit = React.forwardRef(({ children, defaultData, onUpdate }, ref)
       text: data.text.trim(),
     };
 
-    if (!cleanData.text) {
-      textField.current.ref.current.select();
-      return;
-    }
-
-    if (!dequal(cleanData, defaultData)) {
+    if (cleanData.text && !dequal(cleanData, defaultData)) {
       onUpdate(cleanData);
     }
 
@@ -65,10 +60,9 @@ const CommentEdit = React.forwardRef(({ children, defaultData, onUpdate }, ref)
     [submit],
   );
 
-  const [handleFieldBlur, handleControlMouseOver, handleControlMouseOut] = useClosableForm(
-    close,
-    isOpened,
-  );
+  const handleFieldBlur = useCallback(() => {
+    submit();
+  }, [submit]);
 
   const handleSubmit = useCallback(() => {
     submit();
@@ -99,13 +93,7 @@ const CommentEdit = React.forwardRef(({ children, defaultData, onUpdate }, ref)
         onBlur={handleFieldBlur}
       />
       <div className={styles.controls}>
-        {/* eslint-disable-next-line jsx-a11y/mouse-events-have-key-events */}
-        <Button
-          positive
-          content={t('action.save')}
-          onMouseOver={handleControlMouseOver}
-          onMouseOut={handleControlMouseOut}
-        />
+        <Button positive content={t('action.save')} />
       </div>
     </Form>
   );

client/src/components/CardModal/DescriptionEdit.jsx

@@ -100,7 +100,6 @@ const DescriptionEdit = React.forwardRef(({ children, defaultValue, onUpdate },
         onChange={setValue}
       />
       <div className={styles.controls}>
-        {/* eslint-disable-next-line jsx-a11y/mouse-events-have-key-events */}
         <Button positive content={t('action.save')} />
       </div>
     </Form>

client/src/components/CardModal/Tasks/NameEdit.jsx

@@ -4,7 +4,7 @@ import { useTranslation } from 'react-i18next';
 import TextareaAutosize from 'react-textarea-autosize';
 import { Button, Form, TextArea } from 'semantic-ui-react';
 
-import { useClosableForm, useField } from '../../../hooks';
+import { useField } from '../../../hooks';
 
 import styles from './NameEdit.module.scss';
 
@@ -28,12 +28,7 @@ const NameEdit = React.forwardRef(({ children, defaultValue, onUpdate }, ref) =>
   const submit = useCallback(() => {
     const cleanValue = value.trim();
 
-    if (!cleanValue) {
-      field.current.ref.current.select();
-      return;
-    }
-
-    if (cleanValue !== defaultValue) {
+    if (cleanValue && cleanValue !== defaultValue) {
       onUpdate(cleanValue);
     }
 
@@ -60,10 +55,9 @@ const NameEdit = React.forwardRef(({ children, defaultValue, onUpdate }, ref) =>
     [submit],
   );
 
-  const [handleFieldBlur, handleControlMouseOver, handleControlMouseOut] = useClosableForm(
-    close,
-    isOpened,
-  );
+  const handleFieldBlur = useCallback(() => {
+    submit();
+  }, [submit]);
 
   const handleSubmit = useCallback(() => {
     submit();
@@ -93,13 +87,7 @@ const NameEdit = React.forwardRef(({ children, defaultValue, onUpdate }, ref) =>
         onBlur={handleFieldBlur}
       />
       <div className={styles.controls}>
-        {/* eslint-disable-next-line jsx-a11y/mouse-events-have-key-events */}
-        <Button
-          positive
-          content={t('action.save')}
-          onMouseOver={handleControlMouseOver}
-          onMouseOut={handleControlMouseOut}
-        />
+        <Button positive content={t('action.save')} />
       </div>
     </Form>
   );

client/src/components/Header/Header.jsx

@@ -2,7 +2,7 @@ import React, { useCallback } from 'react';
 import PropTypes from 'prop-types';
 import classNames from 'classnames';
 import { Link } from 'react-router-dom';
-import { Icon, Menu } from 'semantic-ui-react';
+import { Button, Icon, Menu } from 'semantic-ui-react';
 import { usePopup } from '../../lib/popup';
 
 import Paths from '../../constants/Paths';
@@ -55,15 +55,16 @@ const Header = React.memo(
               >
                 <Icon fitted name="arrow left" />
               </Menu.Item>
-              <Menu.Item
-                className={classNames(
-                  styles.item,
-                  canEditProject && styles.itemHoverable,
-                  styles.title,
-                )}
+              <Menu.Item className={classNames(styles.item, styles.title)}>
+                {project.name}
+                {canEditProject && (
+                  <Button
+                    className={classNames(styles.editButton, styles.target)}
                     onClick={handleProjectSettingsClick}
                   >
-                {project.name}
+                    <Icon fitted name="pencil" size="small" />
+                  </Button>
+                )}
               </Menu.Item>
             </Menu.Menu>
           )}

client/src/components/Header/Header.module.scss

@@ -1,4 +1,20 @@
 :global(#app) {
+  .editButton {
+    background: transparent;
+    box-shadow: none;
+    color: #fff;
+    font-size: 15px;
+    line-height: 34px;
+    margin-left: 8px;
+    opacity: 0;
+    padding: 0;
+    width: 34px;
+
+    &:hover {
+      background: rgba(255, 255, 255, 0.08);
+    }
+  }
+
   .item {
     cursor: auto;
     user-select: auto;
@@ -11,6 +27,10 @@
     &:hover {
       background: transparent;
       color: rgba(255, 255, 255, 0.9);
+
+      .target {
+        opacity: 1;
+      }
     }
   }
 

client/src/components/Login/Login.jsx

@@ -3,7 +3,7 @@ import React, { useCallback, useEffect, useMemo, useRef } from 'react';
 import PropTypes from 'prop-types';
 import classNames from 'classnames';
 import { useTranslation } from 'react-i18next';
-import { Form, Grid, Header, Message } from 'semantic-ui-react';
+import { Button, Form, Grid, Header, Message } from 'semantic-ui-react';
 import { useDidUpdate, usePrevious, useToggle } from '../../lib/hooks';
 import { Input } from '../../lib/custom-ui';
 
@@ -28,6 +28,21 @@ const createMessage = (error) => {
         type: 'error',
         content: 'common.invalidPassword',
       };
+    case 'Use single sign-on':
+      return {
+        type: 'error',
+        content: 'common.useSingleSignOn',
+      };
+    case 'Email already in use':
+      return {
+        type: 'error',
+        content: 'common.emailAlreadyInUse',
+      };
+    case 'Username already in use':
+      return {
+        type: 'error',
+        content: 'common.usernameAlreadyInUse',
+      };
     case 'Failed to fetch':
       return {
         type: 'warning',
@@ -47,7 +62,16 @@ const createMessage = (error) => {
 };
 
 const Login = React.memo(
-  ({ defaultData, isSubmitting, error, onAuthenticate, onMessageDismiss }) => {
+  ({
+    defaultData,
+    isSubmitting,
+    isSubmittingUsingOidc,
+    error,
+    withOidc,
+    onAuthenticate,
+    onAuthenticateUsingOidc,
+    onMessageDismiss,
+  }) => {
     const [t] = useTranslation();
     const wasSubmitting = usePrevious(isSubmitting);
 
@@ -168,9 +192,19 @@ const Login = React.memo(
                         content={t('action.logIn')}
                         floated="right"
                         loading={isSubmitting}
-                        disabled={isSubmitting}
+                        disabled={isSubmitting || isSubmittingUsingOidc}
                       />
                     </Form>
+                    {withOidc && (
+                      <Button
+                        type="button"
+                        loading={isSubmittingUsingOidc}
+                        disabled={isSubmitting || isSubmittingUsingOidc}
+                        onClick={onAuthenticateUsingOidc}
+                      >
+                        {t('action.logInWithSSO')}
+                      </Button>
+                    )}
                   </div>
                 </div>
               </Grid.Column>
@@ -201,10 +235,15 @@ const Login = React.memo(
 );
 
 Login.propTypes = {
-  defaultData: PropTypes.object.isRequired, // eslint-disable-line react/forbid-prop-types
+  /* eslint-disable react/forbid-prop-types */
+  defaultData: PropTypes.object.isRequired,
+  /* eslint-enable react/forbid-prop-types */
   isSubmitting: PropTypes.bool.isRequired,
+  isSubmittingUsingOidc: PropTypes.bool.isRequired,
   error: PropTypes.object, // eslint-disable-line react/forbid-prop-types
+  withOidc: PropTypes.bool.isRequired,
   onAuthenticate: PropTypes.func.isRequired,
+  onAuthenticateUsingOidc: PropTypes.func.isRequired,
   onMessageDismiss: PropTypes.func.isRequired,
 };
 

client/src/components/LoginWrapper.jsx

@@ -0,0 +1,19 @@
+import React from 'react';
+import PropTypes from 'prop-types';
+import { Loader } from 'semantic-ui-react';
+
+import LoginContainer from '../containers/LoginContainer';
+
+const LoginWrapper = React.memo(({ isInitializing }) => {
+  if (isInitializing) {
+    return <Loader active size="massive" />;
+  }
+
+  return <LoginContainer />;
+});
+
+LoginWrapper.propTypes = {
+  isInitializing: PropTypes.bool.isRequired,
+};
+
+export default LoginWrapper;

client/src/components/Root.jsx

@@ -5,7 +5,7 @@ import { Route, Routes } from 'react-router-dom';
 import { ReduxRouter } from '../lib/redux-router';
 
 import Paths from '../constants/Paths';
-import LoginContainer from '../containers/LoginContainer';
+import LoginWrapperContainer from '../containers/LoginWrapperContainer';
 import CoreContainer from '../containers/CoreContainer';
 import NotFound from './NotFound';
 
@@ -13,7 +13,6 @@ import 'react-datepicker/dist/react-datepicker.css';
 import 'photoswipe/dist/photoswipe.css';
 import 'easymde/dist/easymde.min.css';
 import '../lib/custom-ui/styles.css';
-
 import '../styles.module.scss';
 
 function Root({ store, history }) {
@@ -21,7 +20,8 @@ function Root({ store, history }) {
     <Provider store={store}>
       <ReduxRouter history={history}>
         <Routes>
-          <Route path={Paths.LOGIN} element={<LoginContainer />} />
+          <Route path={Paths.LOGIN} element={<LoginWrapperContainer />} />
+          <Route path={Paths.OIDC_CALLBACK} element={<LoginWrapperContainer />} />
           <Route path={Paths.ROOT} element={<CoreContainer />} />
           <Route path={Paths.PROJECTS} element={<CoreContainer />} />
           <Route path={Paths.BOARDS} element={<CoreContainer />} />

client/src/components/UserInformationEdit/UserInformationEdit.jsx

@@ -1,4 +1,5 @@
 import { dequal } from 'dequal';
+import omit from 'lodash/omit';
 import pickBy from 'lodash/pickBy';
 import React, { useCallback, useMemo, useRef } from 'react';
 import PropTypes from 'prop-types';
@@ -9,7 +10,7 @@ import { useForm } from '../../hooks';
 
 import styles from './UserInformationEdit.module.scss';
 
-const UserInformationEdit = React.memo(({ defaultData, onUpdate }) => {
+const UserInformationEdit = React.memo(({ defaultData, isNameEditable, onUpdate }) => {
   const [t] = useTranslation();
 
   const [data, handleFieldChange] = useForm(() => ({
@@ -32,13 +33,17 @@ const UserInformationEdit = React.memo(({ defaultData, onUpdate }) => {
   const nameField = useRef(null);
 
   const handleSubmit = useCallback(() => {
+    if (isNameEditable) {
       if (!cleanData.name) {
         nameField.current.select();
         return;
       }
 
       onUpdate(cleanData);
-  }, [onUpdate, cleanData]);
+    } else {
+      onUpdate(omit(cleanData, 'name'));
+    }
+  }, [isNameEditable, onUpdate, cleanData]);
 
   return (
     <Form onSubmit={handleSubmit}>
@@ -48,6 +53,7 @@ const UserInformationEdit = React.memo(({ defaultData, onUpdate }) => {
         ref={nameField}
         name="name"
         value={data.name}
+        disabled={!isNameEditable}
         className={styles.field}
         onChange={handleFieldChange}
       />
@@ -74,6 +80,7 @@ const UserInformationEdit = React.memo(({ defaultData, onUpdate }) => {
 
 UserInformationEdit.propTypes = {
   defaultData: PropTypes.object.isRequired, // eslint-disable-line react/forbid-prop-types
+  isNameEditable: PropTypes.bool.isRequired,
   onUpdate: PropTypes.func.isRequired,
 };
 

client/src/components/UserInformationEditStep.jsx

@@ -5,7 +5,8 @@ import { Popup } from '../lib/custom-ui';
 
 import UserInformationEdit from './UserInformationEdit';
 
-const UserInformationEditStep = React.memo(({ defaultData, onUpdate, onBack, onClose }) => {
+const UserInformationEditStep = React.memo(
+  ({ defaultData, isNameEditable, onUpdate, onBack, onClose }) => {
     const [t] = useTranslation();
 
     const handleUpdate = useCallback(
@@ -24,14 +25,20 @@ const UserInformationEditStep = React.memo(({ defaultData, onUpdate, onBack, onC
           })}
         </Popup.Header>
         <Popup.Content>
-        <UserInformationEdit defaultData={defaultData} onUpdate={handleUpdate} />
+          <UserInformationEdit
+            defaultData={defaultData}
+            isNameEditable={isNameEditable}
+            onUpdate={handleUpdate}
+          />
         </Popup.Content>
       </>
     );
-});
+  },
+);
 
 UserInformationEditStep.propTypes = {
   defaultData: PropTypes.object.isRequired, // eslint-disable-line react/forbid-prop-types
+  isNameEditable: PropTypes.bool.isRequired,
   onUpdate: PropTypes.func.isRequired,
   onBack: PropTypes.func,
   onClose: PropTypes.func.isRequired,

client/src/components/UserSettingsModal/AccountPane/AccountPane.jsx

@@ -23,6 +23,7 @@ const AccountPane = React.memo(
     phone,
     organization,
     language,
+    isLocked,
     isAvatarUpdating,
     usernameUpdateForm,
     emailUpdateForm,
@@ -74,6 +75,7 @@ const AccountPane = React.memo(
             phone,
             organization,
           }}
+          isNameEditable={!isLocked}
           onUpdate={onUpdate}
         />
         <Divider horizontal section>
@@ -102,6 +104,8 @@ const AccountPane = React.memo(
           value={language || 'auto'}
           onChange={handleLanguageChange}
         />
+        {!isLocked && (
+          <>
             <Divider horizontal section>
               <Header as="h4">
                 {t('common.authentication', {
@@ -159,6 +163,8 @@ const AccountPane = React.memo(
                 </Button>
               </UserPasswordEditPopup>
             </div>
+          </>
+        )}
       </Tab.Pane>
     );
   },
@@ -172,6 +178,7 @@ AccountPane.propTypes = {
   phone: PropTypes.string,
   organization: PropTypes.string,
   language: PropTypes.string,
+  isLocked: PropTypes.bool.isRequired,
   isAvatarUpdating: PropTypes.bool.isRequired,
   /* eslint-disable react/forbid-prop-types */
   usernameUpdateForm: PropTypes.object.isRequired,

client/src/components/UserSettingsModal/UserSettingsModal.jsx

@@ -17,6 +17,7 @@ const UserSettingsModal = React.memo(
     organization,
     language,
     subscribeToOwnCards,
+    isLocked,
     isAvatarUpdating,
     usernameUpdateForm,
     emailUpdateForm,
@@ -48,6 +49,7 @@ const UserSettingsModal = React.memo(
             phone={phone}
             organization={organization}
             language={language}
+            isLocked={isLocked}
             isAvatarUpdating={isAvatarUpdating}
             usernameUpdateForm={usernameUpdateForm}
             emailUpdateForm={emailUpdateForm}
@@ -105,6 +107,7 @@ UserSettingsModal.propTypes = {
   organization: PropTypes.string,
   language: PropTypes.string,
   subscribeToOwnCards: PropTypes.bool.isRequired,
+  isLocked: PropTypes.bool.isRequired,
   isAvatarUpdating: PropTypes.bool.isRequired,
   /* eslint-disable react/forbid-prop-types */
   usernameUpdateForm: PropTypes.object.isRequired,

client/src/components/UsersModal/Item/ActionsStep.jsx

@@ -64,6 +64,7 @@ const ActionsStep = React.memo(
           return (
             <UserInformationEditStep
               defaultData={pick(user, ['name', 'phone', 'organization'])}
+              isNameEditable={!user.isLocked}
               onUpdate={onUpdate}
               onBack={handleBack}
               onClose={onClose}
@@ -135,6 +136,8 @@ const ActionsStep = React.memo(
                 context: 'title',
               })}
             </Menu.Item>
+            {!user.isLocked && (
+              <>
                 <Menu.Item className={styles.menuItem} onClick={handleEditUsernameClick}>
                   {t('action.editUsername', {
                     context: 'title',
@@ -150,11 +153,15 @@ const ActionsStep = React.memo(
                     context: 'title',
                   })}
                 </Menu.Item>
+              </>
+            )}
+            {!user.isLockedAdmin && (
               <Menu.Item className={styles.menuItem} onClick={handleDeleteClick}>
                 {t('action.deleteUser', {
                   context: 'title',
                 })}
               </Menu.Item>
+            )}
           </Menu>
         </Popup.Content>
       </>

client/src/components/UsersModal/Item/Item.jsx

@@ -17,6 +17,8 @@ const Item = React.memo(
     organization,
     phone,
     isAdmin,
+    isLocked,
+    isLockedAdmin,
     emailUpdateForm,
     passwordUpdateForm,
     usernameUpdateForm,
@@ -46,7 +48,7 @@ const Item = React.memo(
         <Table.Cell>{username || '-'}</Table.Cell>
         <Table.Cell>{email}</Table.Cell>
         <Table.Cell>
-          <Radio toggle checked={isAdmin} onChange={handleIsAdminChange} />
+          <Radio toggle checked={isAdmin} disabled={isLockedAdmin} onChange={handleIsAdminChange} />
         </Table.Cell>
         <Table.Cell textAlign="right">
           <ActionsPopup
@@ -57,6 +59,8 @@ const Item = React.memo(
               organization,
               phone,
               isAdmin,
+              isLocked,
+              isLockedAdmin,
               emailUpdateForm,
               passwordUpdateForm,
               usernameUpdateForm,
@@ -88,6 +92,8 @@ Item.propTypes = {
   organization: PropTypes.string,
   phone: PropTypes.string,
   isAdmin: PropTypes.bool.isRequired,
+  isLocked: PropTypes.bool.isRequired,
+  isLockedAdmin: PropTypes.bool.isRequired,
   /* eslint-disable react/forbid-prop-types */
   emailUpdateForm: PropTypes.object.isRequired,
   passwordUpdateForm: PropTypes.object.isRequired,

client/src/components/UsersModal/UsersModal.jsx

@@ -110,6 +110,8 @@ const UsersModal = React.memo(
                   organization={item.organization}
                   phone={item.phone}
                   isAdmin={item.isAdmin}
+                  isLocked={item.isLocked}
+                  isLockedAdmin={item.isLockedAdmin}
                   emailUpdateForm={item.emailUpdateForm}
                   passwordUpdateForm={item.passwordUpdateForm}
                   usernameUpdateForm={item.usernameUpdateForm}

client/src/constants/ActionTypes.js

@@ -12,9 +12,13 @@ export default {
 
   /* Login */
 
+  LOGIN_INITIALIZE: 'LOGIN_INITIALIZE',
   AUTHENTICATE: 'AUTHENTICATE',
   AUTHENTICATE__SUCCESS: 'AUTHENTICATE__SUCCESS',
   AUTHENTICATE__FAILURE: 'AUTHENTICATE__FAILURE',
+  USING_OIDC_AUTHENTICATE: 'USING_OIDC_AUTHENTICATE',
+  USING_OIDC_AUTHENTICATE__SUCCESS: 'USING_OIDC_AUTHENTICATE__SUCCESS',
+  USING_OIDC_AUTHENTICATE__FAILURE: 'USING_OIDC_AUTHENTICATE__FAILURE',
   AUTHENTICATE_ERROR_CLEAR: 'AUTHENTICATE_ERROR_CLEAR',
 
   /* Core */

client/src/constants/EntryActionTypes.js

@@ -11,11 +11,11 @@ export default {
   /* Login */
 
   AUTHENTICATE: `${PREFIX}/AUTHENTICATE`,
+  USING_OIDC_AUTHENTICATE: `${PREFIX}/USING_OIDC_AUTHENTICATE`,
   AUTHENTICATE_ERROR_CLEAR: `${PREFIX}/AUTHENTICATE_ERROR_CLEAR`,
 
   /* Core */
 
-  CORE_INITIALIZE: `${PREFIX}/CORE_INITIALIZE`,
   LOGOUT: `${PREFIX}/LOGOUT`,
 
   /* Modals */

client/src/constants/Paths.js

@@ -2,6 +2,7 @@ import Config from './Config';
 
 const ROOT = `${Config.BASE_PATH}/`;
 const LOGIN = `${Config.BASE_PATH}/login`;
+const OIDC_CALLBACK = `${Config.BASE_PATH}/oidc-callback`;
 const PROJECTS = `${Config.BASE_PATH}/projects/:id`;
 const BOARDS = `${Config.BASE_PATH}/boards/:id`;
 const CARDS = `${Config.BASE_PATH}/cards/:id`;
@@ -9,6 +10,7 @@ const CARDS = `${Config.BASE_PATH}/cards/:id`;
 export default {
   ROOT,
   LOGIN,
+  OIDC_CALLBACK,
   PROJECTS,
   BOARDS,
   CARDS,

client/src/containers/CoreContainer.js

@@ -4,18 +4,18 @@ import selectors from '../selectors';
 import Core from '../components/Core';
 
 const mapStateToProps = (state) => {
-  const isCoreInitializing = selectors.selectIsCoreInitializing(state);
+  const isInitializing = selectors.selectIsInitializing(state);
   const isSocketDisconnected = selectors.selectIsSocketDisconnected(state);
   const currentModal = selectors.selectCurrentModal(state);
   const currentProject = selectors.selectCurrentProject(state);
   const currentBoard = selectors.selectCurrentBoard(state);
 
   return {
+    isInitializing,
     isSocketDisconnected,
     currentModal,
     currentProject,
     currentBoard,
-    isInitializing: isCoreInitializing,
   };
 };
 

client/src/containers/LoginContainer.js

@@ -1,23 +1,33 @@
 import { bindActionCreators } from 'redux';
 import { connect } from 'react-redux';
 
+import selectors from '../selectors';
 import entryActions from '../entry-actions';
 import Login from '../components/Login';
 
-const mapStateToProps = ({
+const mapStateToProps = (state) => {
+  const oidcConfig = selectors.selectOidcConfig(state);
+
+  const {
     ui: {
-    authenticateForm: { data: defaultData, isSubmitting, error },
+      authenticateForm: { data: defaultData, isSubmitting, isSubmittingUsingOidc, error },
     },
-}) => ({
+  } = state;
+
+  return {
     defaultData,
     isSubmitting,
+    isSubmittingUsingOidc,
     error,
-});
+    withOidc: !!oidcConfig,
+  };
+};
 
 const mapDispatchToProps = (dispatch) =>
   bindActionCreators(
     {
       onAuthenticate: entryActions.authenticate,
+      onAuthenticateUsingOidc: entryActions.authenticateUsingOidc,
       onMessageDismiss: entryActions.clearAuthenticateError,
     },
     dispatch,

client/src/containers/LoginWrapperContainer.js

@@ -0,0 +1,14 @@
+import { connect } from 'react-redux';
+
+import selectors from '../selectors';
+import LoginWrapper from '../components/LoginWrapper';
+
+const mapStateToProps = (state) => {
+  const isInitializing = selectors.selectIsInitializing(state);
+
+  return {
+    isInitializing,
+  };
+};
+
+export default connect(mapStateToProps)(LoginWrapper);

client/src/containers/UserSettingsModalContainer.js

@@ -15,6 +15,7 @@ const mapStateToProps = (state) => {
     organization,
     language,
     subscribeToOwnCards,
+    isLocked,
     isAvatarUpdating,
     emailUpdateForm,
     passwordUpdateForm,
@@ -30,6 +31,7 @@ const mapStateToProps = (state) => {
     organization,
     language,
     subscribeToOwnCards,
+    isLocked,
     isAvatarUpdating,
     emailUpdateForm,
     passwordUpdateForm,

client/src/entry-actions/core.js

@@ -1,16 +1,10 @@
 import EntryActionTypes from '../constants/EntryActionTypes';
 
-const initializeCore = () => ({
-  type: EntryActionTypes.CORE_INITIALIZE,
-  payload: {},
-});
-
 const logout = () => ({
   type: EntryActionTypes.LOGOUT,
   payload: {},
 });
 
 export default {
-  initializeCore,
   logout,
 };

client/src/entry-actions/login.js

@@ -7,6 +7,11 @@ const authenticate = (data) => ({
   },
 });
 
+const authenticateUsingOidc = () => ({
+  type: EntryActionTypes.USING_OIDC_AUTHENTICATE,
+  payload: {},
+});
+
 const clearAuthenticateError = () => ({
   type: EntryActionTypes.AUTHENTICATE_ERROR_CLEAR,
   payload: {},
@@ -14,5 +19,6 @@ const clearAuthenticateError = () => ({
 
 export default {
   authenticate,
+  authenticateUsingOidc,
   clearAuthenticateError,
 };

client/src/locales/cs/core.js

@@ -13,6 +13,7 @@ export default {
 
   translation: {
     common: {
+      aboutPlanka: 'O aplikaci Planka',
       account: 'Účet',
       actions: 'Akce',
       addAttachment_title: 'Přidat přílohu',
@@ -45,6 +46,9 @@ export default {
       background: 'Pozadí',
       board: 'Tabule',
       boardNotFound_title: 'Tabule nenalezena',
+      canComment: 'Může komentovat',
+      canEditContentOfBoard: 'Může upravovat obsah tabule',
+      canOnlyViewBoard: 'Může zobrazit pouze tabuli',
       cardActions_title: 'Akce na kartě',
       cardNotFound_title: 'Karta nenalezena',
       cardOrActionAreDeleted: 'Karta nebo akce je smazána',
@@ -68,14 +72,18 @@ export default {
       deleteTask_title: 'Smazat úkol',
       deleteUser_title: 'Smazat uživatele',
       description: 'Popis',
+      detectAutomatically: 'Automatická detekce',
       dropFileToUpload: 'Přetáhnutím nahraj soubor',
+      editor: 'Editor',
       editAttachment_title: 'Upravit přílohu',
       editAvatar_title: 'Upravit avatar',
       editBoard_title: 'Upravit tabuli',
       editDueDate_title: 'Upravit Termín do',
       editEmail_title: 'Upravit e-mail',
+      editInformation_title: 'Upravit informace',
       editLabel_title: 'Upravit štítek',
       editPassword_title: 'Upravit heslo',
+      editPermissions_title: 'Upravit oprávnění',
       editStopwatch_title: 'Upravit časovač',
       editUsername_title: 'Upravit uživatelské jméno',
       email: 'E-mail',
@@ -89,10 +97,13 @@ export default {
       filterByLabels_title: 'Filtruj podle štítku',
       filterByMembers_title: 'Filtruj podle člena',
       fromComputer_title: 'Z počítače',
+      fromTrello: 'Z Trella',
       general: 'Obecné',
       hours: 'Hodiny',
+      importBoard_title: 'Importovat tabuli',
       invalidCurrentPassword: 'Neplatné aktuální heslo',
       labels: 'Štítky',
+      language: 'Jazyk',
       leaveBoard_title: 'Opustit tabuli',
       leaveProject_title: 'Opustit projekt',
       list: 'Seznam',
@@ -122,15 +133,20 @@ export default {
       projectNotFound_title: 'Projekt nenalezen',
       removeManager_title: 'Odstranit vedoucího',
       removeMember_title: 'Odstranit člena',
+      searchLabels: 'Hledat štítky...',
+      searchMembers: 'Hledat členy...',
+      searchUsers: 'Hledat uživatele...',
       seconds: 'Vteřin',
       selectBoard: 'Vybrat tabuli',
       selectList: 'Vybrat seznam',
+      selectPermissions_title: 'Vybrat oprávnění',
       selectProject: 'Vybrat projekt',
       settings: 'Nastavení',
       stopwatch: 'Časovač',
       subscribeToMyOwnCardsByDefault: 'Ve výchozím nastavení odebírat vlastní karty',
       taskActions_title: 'Akce na úkolu',
       tasks: 'Úkoly',
+      thereIsNoPreviewAvailableForThisAttachment: 'Pro tuto přílohu není k dispozici žádný náhled',
       time: 'Čas',
       title: 'Titulek',
       userActions_title: 'Akce na uživateli',
@@ -142,6 +158,8 @@ export default {
       username: 'Uživatelské jméno',
       usernameAlreadyInUse: 'Uživatelské jméno se již používá',
       users: 'Uživatelé',
+      version: 'Verze',
+      viewer: 'Prohlížeč',
       writeComment: 'Napsat komentář...',
     },
 
@@ -153,6 +171,7 @@ export default {
       addCard_title: 'Přidat kartu',
       addComment: 'Přidat komentář',
       addList: 'Přidat seznam',
+      addMember: 'Přidat člena',
       addMoreDetailedDescription: 'Přidat další detailní popis',
       addTask: 'Přidat úkol',
       addToCard: 'Přidat na kartu',
@@ -182,10 +201,14 @@ export default {
       editDueDate_title: 'Upravit termín do',
       editDescription_title: 'Upravit popis',
       editEmail_title: 'Upravit e-mail',
+      editInformation_title: 'Upravit informace',
       editPassword_title: 'Upravit heslo',
+      editPermissions: 'Upravit oprávnění',
       editStopwatch_title: 'Upravit časovač',
       editTitle_title: 'Upravit titulek',
       editUsername_title: 'Upravit uživatelské jméno',
+      hideDetails: 'Skrýt detaily',
+      import: 'Import',
       leaveBoard: 'Opustit tabuli',
       leaveProject: 'Opustit projekt',
       logOut_title: 'Odhlásit se',
@@ -202,6 +225,7 @@ export default {
       save: 'Uložit',
       showAllAttachments: 'Zozbrazit všechny přílohy ({{hidden}} skryté)',
       showFewerAttachments: 'Zobrazit méně příloh',
+      showDetails: 'Zobrazit detaily',
       start: 'Start',
       stop: 'Stop',
       subscribe: 'Odebírat',

client/src/locales/en/login.js

@@ -11,10 +11,12 @@ export default {
       projectManagement: 'Project management',
       serverConnectionFailed: 'Server connection failed',
       unknownError: 'Unknown error, try again later',
+      useSingleSignOn: 'Use single sign-on',
     },
 
     action: {
       logIn: 'Log in',
+      logInWithSSO: 'Log in with SSO',
     },
   },
 };

client/src/locales/index.js

@@ -11,10 +11,11 @@ import pl from './pl';
 import ru from './ru';
 import sk from './sk';
 import sv from './sv';
+import tr from './tr';
 import uz from './uz';
 import zh from './zh';
 
-const locales = [cs, da, de, en, es, fr, it, ja, ko, pl, ru, sk, sv, uz, zh];
+const locales = [cs, da, de, en, es, fr, it, ja, ko, pl, ru, sk, sv, tr, uz, zh];
 
 export default locales;
 

client/src/locales/ru/core.js

@@ -13,10 +13,12 @@ export default {
 
   translation: {
     common: {
+      aboutPlanka: 'О проекте Planka',
       account: 'Учетная запись',
       actions: 'Действия',
       addAttachment: 'Добавление вложения',
       addComment: 'Добавление комментария',
+      addManager_title: 'Добавление менеджера',
       addMember: 'Добавление участника',
       addUser: 'Добавление пользователя',
       administrator: 'Администратор',
@@ -32,11 +34,16 @@ export default {
       areYouSureYouWantToDeleteThisProject: 'Вы уверены, что хотите удалить этот проект?',
       areYouSureYouWantToDeleteThisTask: 'Вы уверены, что хотите удалить эту задачу?',
       areYouSureYouWantToDeleteThisUser: 'Вы уверены, что хотите удалить этого пользователя?',
-      areYouSureYouWantToRemoveThisMemberFromProject:
-        'Вы уверены, что хотите удалить этого участника из проекта?',
+      areYouSureYouWantToLeaveBoard: 'Вы уверены, что хотите покинуть эту доску?',
+      areYouSureYouWantToLeaveProject: 'Вы уверены, что хотите покинуть этот проект?',
+      areYouSureYouWantToRemoveThisManagerFromProject:
+        'Вы уверены, что хотите удалить этого менеджера из проекта?',
+      areYouSureYouWantToRemoveThisMemberFromBoard:
+        'Вы уверены, что хотите удалить этого участника из доски?',
       attachment: 'Вложение',
       attachments: 'Вложения',
       authentication: 'Аутентификация',
+      background: 'Фон',
       board: 'Доска',
       boardNotFound: 'Доска не найдена',
       canComment: 'Может комментировать',
@@ -53,6 +60,7 @@ export default {
       createProject: 'Создание проекта',
       createTextFile: 'Создание текстового файла',
       currentPassword: 'Текущий пароль',
+      dangerZone_title: 'Опасная зона',
       date: 'Дата',
       dueDate: 'Срок',
       deleteAttachment: 'Удаление вложения',
@@ -74,7 +82,8 @@ export default {
       editBackground: 'Изменение фона',
       editDueDate: 'Изменение срока',
       editEmail: 'Изменение e-mail',
-      editLabel: 'Изменения метки',
+      editInformation: 'Изменение информации',
+      editLabel: 'Изменение метки',
       editPassword: 'Изменение пароля',
       editPermissions: 'Редактирование разрешений',
       editStopwatch: 'Изменение секундомера',
@@ -91,12 +100,18 @@ export default {
       filterByLabels: 'Фильтр по меткам',
       filterByMembers: 'Фильтр по участникам',
       fromComputer: 'С компьютера',
+      fromTrello: 'Из Trello',
+      general: 'Основные',
       hours: 'Часы',
+      importBoard: 'Импорт доски',
       invalidCurrentPassword: 'Неверный текущий пароль',
       labels: 'Метки',
       language: 'Язык',
+      leaveBoard: 'Покинуть доску',
+      leaveProject: 'Покинуть проект',
       list: 'Список',
       listActions: 'Действия со списком',
+      managers: 'Менеджеры',
       members: 'Участники',
       minutes: 'Минуты',
       moveCard: 'Перемещение карточки',
@@ -120,6 +135,7 @@ export default {
       project: 'Проект',
       projectActions: 'Действия с проектом',
       projectNotFound: 'Проект не найден',
+      removeManager: 'Удалить менеджера',
       removeMember: 'Удаление участника',
       searchLabels: 'Поиск меток...',
       searchMembers: 'Поиск участников...',
@@ -131,7 +147,7 @@ export default {
       selectProject: 'Выберите проект',
       settings: 'Настройки',
       stopwatch: 'Секундомер',
-      subscribeToMyOwnCardsByDefault: 'По умолчанию подписаться на мои собственные карточки',
+      subscribeToMyOwnCardsByDefault: 'По умолчанию подписываться на мои собственные карточки',
       taskActions: 'Действия с задачей',
       tasks: 'Задачи',
       thereIsNoPreviewAvailableForThisAttachment: 'Предпросмотр для этого вложения недоступен',
@@ -147,6 +163,7 @@ export default {
       username: 'Имя пользователя',
       usernameAlreadyInUse: 'Имя пользователя уже занято',
       users: 'Пользователи',
+      version: 'Версия',
       viewer: 'Читатель',
       writeComment: 'Напишите комментарий...',
     },
@@ -185,6 +202,7 @@ export default {
       editDueDate: 'Изменить срок',
       editDescription: 'Изменить описание',
       editEmail: 'Изменить e-mail',
+      editInformation: 'Изменить информацию',
       editPassword: 'Изменить пароль',
       editPermissions: 'Изменить разрешения',
       editStopwatch: 'Изменить секундомер',
@@ -192,6 +210,9 @@ export default {
       editTitle: 'Изменить название',
       editUsername: 'Изменить имя пользователя',
       hideDetails: 'Скрыть подробности',
+      import: 'Импорт',
+      leaveBoard: 'Покинуть доску',
+      leaveProject: 'Покинуть проект',
       logOut: 'Выйти',
       makeCover: 'Сделать обложкой',
       move: 'Переместить',
@@ -199,7 +220,9 @@ export default {
       remove: 'Убрать',
       removeBackground: 'Убрать фон',
       removeCover: 'Убрать обложку',
+      removeFromBoard: 'Удалить из доски',
       removeFromProject: 'Удалить из проекта',
+      removeManager: 'Удалить менеджера',
       removeMember: 'Удалить участника',
       save: 'Сохранить',
       showAllAttachments: 'Показать все вложения ({{hidden}} скрыто)',

client/src/locales/tr/core.js

@@ -0,0 +1,219 @@
+import dateFns from 'date-fns/locale/tr';
+
+export default {
+  dateFns,
+
+  format: {
+    date: 'd.MM.yyyy',
+    time: 'p',
+    dateTime: '$t(format:date) $t(format:time)',
+    longDate: 'd. MMM',
+    longDateTime: "d. MMMM 'Saat' p",
+  },
+
+  translation: {
+    common: {
+      account: 'Hesap',
+      actions: 'Eylemler',
+      addAttachment_title: 'Dosya ekle',
+      addComment: 'Yorum ekle',
+      addManager_title: 'Yönetici ekle',
+      addMember_title: 'Üye ekle',
+      addUser_title: 'Kullanıcı ekle',
+      administrator: 'Administrator',
+      all: 'Tümü',
+      allChangesWillBeAutomaticallySavedAfterConnectionRestored:
+        'Bağlantı yeniden kurulduğunda tüm değişiklikler kaydedilecektir.',
+      areYouSureYouWantToDeleteThisAttachment: 'Bu eki silmek istediğinize emin misiniz?',
+      areYouSureYouWantToDeleteThisBoard: 'Bu panoyu silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisCard: 'Bu kartı silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisComment: 'Bu yorumu silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisLabel: 'Bu etiketi silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisList: 'Bu listeyi silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisProject: 'Bu projeyi silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisTask: 'Bu görevi silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisUser: 'Bu kullanıcıyı silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToLeaveBoard: 'Panodan ayrılmak istediğinizden emin misiniz?',
+      areYouSureYouWantToLeaveProject: 'Projeden ayrılmak istediğinizden emin misiniz?',
+      areYouSureYouWantToRemoveThisManagerFromProject:
+        'Bu yöneticiyi projeden çıkarmak istediğinizden emin misiniz?',
+      areYouSureYouWantToRemoveThisMemberFromBoard:
+        'Bu üyeyi panodan çıkarmak istediğinizden emin misiniz?',
+      attachment: 'ek',
+      attachments: 'ekler',
+      authentication: 'kimlik doğrulama',
+      background: 'arka plan',
+      board: 'pano',
+      boardNotFound_title: 'Pano bulunamadı',
+      cardActions_title: 'Kart İşlemleri',
+      cardNotFound_title: 'Kart bulunamadı',
+      cardOrActionAreDeleted: 'Kart veya işlem silindi',
+      color: 'renk',
+      createBoard_title: 'Pano Oluştur',
+      createLabel_title: 'Etiket Oluştur',
+      createNewOneOrSelectExistingOne: 'Yeni bir tane oluşturun veya mevcut bir tanesini seçin.',
+      createProject_title: 'Proje Oluştur',
+      createTextFile_title: 'Metin Dosyası Oluştur',
+      currentPassword: 'Geçerli şifre',
+      dangerZone_title: 'Tehlikeli Bölge',
+      date: 'tarih',
+      dueDate_title: 'Termin Tarihi',
+      deleteAttachment_title: 'Eki Sil',
+      deleteBoard_title: 'Panoyu Sil',
+      deleteCard_title: 'Kartı Sil',
+      deleteComment_title: 'Yorumu Sil',
+      deleteLabel_title: 'Etiketi Sil',
+      deleteList_title: 'Listeyi Sil',
+      deleteProject_title: 'Projeyi Sil',
+      deleteTask_title: 'Görevi Sil',
+      deleteUser_title: 'Kullanıcıyı Sil',
+      description: 'açıklama',
+      detectAutomaically: 'Otomatik olarak algıla',
+      dropFileToUpload: 'Yüklenecek dosyayı buraya bırakın',
+      editAttachment_title: 'Eki Düzenle',
+      editAvatar_title: 'Avatarı Düzenle',
+      editBoard_title: 'Panoyu Düzenle',
+      editDueDate_title: 'Son Tarihi Düzenle',
+      editEmail_title: 'E-posta Adresini Düzenle',
+      editLabel_title: 'Etiketi Düzenle',
+      editPassword_title: 'Şifreyi Değiştir',
+      editStopwatch_title: 'Kronometreyi Düzenle',
+      editUsername_title: 'Kullanıcı Adını Düzenle',
+      email: 'e-posta',
+      emailAlreadyInUse: 'E-posta adresi zaten kullanımda',
+      enterCardTitle: 'Kart başlığını girin',
+      enterDescription: 'Açıklamayı girin',
+      enterFilename: 'Dosya adını girin',
+      enterListTitle: 'Liste başlığını girin',
+      enterProjectTitle: 'Proje başlığını girin',
+      enterTaskDescription: 'Görev açıklamasını girin',
+      filterByLabels_title: 'Etikete Göre Filtrele',
+      filterByMembers_title: 'Üyelere göre filtrele',
+      fromComputer_title: 'Bilgisayardan',
+      general: 'Genel',
+      hours: 'saat',
+      invalidCurrentPassword: 'Mevcut şifre yanlış',
+      labels: 'etiketler',
+      language: 'dil',
+      leaveBoard_title: 'Panodan Ayrıl',
+      leaveProject_title: 'Projeden Ayrıl',
+      list: 'Listeler',
+      listActions_title: 'Görevleri Listele',
+      managers: 'Yöneticiler',
+      members: 'Üyeler',
+      minutes: 'dakika',
+      moveCard_title: 'Kartı Taşı',
+      name: 'isim',
+      newEmail: 'Yeni e-posta adresi',
+      newPassword: 'Yeni şifre',
+      newUsername: 'Yeni kullanıcı adı',
+      noConnectionToServer: 'Sunucuya bağlantı yok',
+      noBoards: 'Pano yok',
+      noLists: 'Liste yok',
+      noProjects: 'Proje yok',
+      notifications: 'Bildirimler',
+      noUnreadNotifications: 'Okunmamış bildirim yok',
+      openBoard_title: 'Açık Pano',
+      optional_inline: 'İsteğe bağlı',
+      organization: 'Organizasyon',
+      phone: 'telefon',
+      preferences: 'Tercihler',
+      pressPasteShortcutToAddAttachmentFromClipboard:
+        'İpucu: Panodan bir ek eklemek için CTRL-V ye (Macte Cmd-V) basın',
+      project: 'Proje',
+      projectNotFound_title: 'Proje bulunamadı',
+      removeManager_title: 'Yöneticiyi Kaldır',
+      removeMember_title: 'Üyeyi Kaldır',
+      seconds: 'saniye',
+      selectBoard: 'Pano Seç',
+      selectList: 'Liste seç',
+      selectProject: 'Proje seç',
+      settings: 'Ayarlar',
+      stopwatch: 'kronometre',
+      subscribeToMyOwnCardsByDefault: 'Varsayılan olarak kendi kartlarıma abone ol',
+      taskActions_title: 'Görev Eylemleri',
+      tasks: 'Görevler',
+      thereIsNoPreviewAvailableForThisAttachment: 'Bu ek için önizleme mevcut değil',
+      time: 'zaman',
+      title: 'başlık',
+      userActions_title: 'Kullanıcı İşlemleri',
+      userAddedThisCardToList: '<0>{{user}}</0><1> bu kartı {{list}</1> listesine ekledi',
+      userLeftNewCommentToCard:
+        '{{user}} yeni bir yorum yazdı: <2>{{card}</2> kartına «{{comment}}»',
+      userMovedCardFromListToList:
+        '{{user}}, <2>{{card}></2> kartını {{fromList}} listesinden {{toList}} listesine taşıdı',
+      userMovedThisCardFromListToList:
+        '<0>{{user}}</0><1> bu kartı {{fromList}} konumundan {{toList}}</1> konumuna taşıdı',
+      username: 'kullanıcı adı',
+      usernameAlreadyInUse: 'Kullanıcı adı zaten kullanımda',
+      users: 'kullanıcı',
+      writeComment: 'Yorum yazın',
+    },
+    action: {
+      addAnotherCard: 'Başka bir kart ekle',
+      addAnotherList: 'Başka bir liste ekle',
+      addAnotherTask: 'Başka bir görev ekle',
+      addCard: 'Kart ekle',
+      addCard_title: 'Kart Ekle',
+      addComment: 'Yorum ekle',
+      addList: 'Liste ekle',
+      addMoreDetailedDescription: 'Ayrıntılı bir açıklama ekleyin',
+      addTask: 'Görev ekle',
+      addToCard: 'Karta ekle',
+      addUser: 'Kullanıcı ekle',
+      createBoard: 'Pano oluştur',
+      createFile: 'Dosya oluştur',
+      createLabel: 'Etiket Oluştur',
+      createNewLabel: 'Yeni etiket oluştur',
+      createProject: 'Proje oluştur',
+      delete: 'Sil',
+      deleteAttachment: 'Eki sil',
+      deleteAvatar: 'Avatarı sil',
+      deleteBoard: 'Panoyu Sil',
+      deleteCard: 'Kartı sil',
+      deleteCard_title: 'Kartı Sil',
+      deleteComment: 'Yorumu sil',
+      deleteImage: 'Resmi sil',
+      deleteLabel: 'Etiketi sil',
+      deleteList: 'Listeyi sil',
+      deleteList_title: 'Listeyi Sil',
+      deleteProject: 'Projeyi sil',
+      deleteProject_title: 'Projeyi Sil',
+      deleteTask: 'Görevi sil',
+      deleteTask_title: 'Görevi Sil',
+      deleteUser: 'Kullanıcıyı sil',
+      edit: 'Düzenle',
+      editDueDate_title: 'Son Tarihi Düzenle',
+      editDescription_title: 'Açıklamayı Düzenle',
+      editEmail_title: 'E-posta Adresini Düzenle',
+      editPassword_title: 'Şifreyi Değiştir',
+      editStopwatch_title: 'Kronometreyi Düzenle',
+      editTitle_title: 'Başlığı düzenle',
+      editUsername_title: 'Kullanıcı Adını Düzenle',
+      hideDetails: 'Ayrıntıları gizle',
+      leaveBoard: 'Panodan Ayrıl',
+      leaveProject: 'Projeden ayrıl',
+      logOut_title: 'Çıkış',
+      makeCover_title: 'Önizleme olarak ayarla',
+      move: 'Taşı',
+      moveCard_title: 'Kartı Taşı',
+      remove: 'Sil',
+      removeBackground: 'Arka planı kaldır',
+      removeCover_title: 'Önizlemeyi Kaldır',
+      removeFromBoard: 'Panodan kaldır',
+      removeFromProject: 'Projeden kaldır',
+      removeManager: 'Yöneticiyi kaldır',
+      removeMember: 'Üyeyi kaldır',
+      save: 'Kaydet',
+      showAllAttachments: 'Tüm ekleri göster ({{hidden}} gizli)',
+      showDetails: 'Ayrıntıları göster',
+      showFewerAttachments: 'Daha az ek göster',
+      start: 'başlat',
+      stop: 'dur',
+      subscribe: 'Abone ol',
+      unsubscribe: 'Abonelikten çık',
+      uploadNewAvatar: 'Yeni avatar yükle',
+      uploadNewImage: 'Yeni resim yükle',
+    },
+  },
+};

client/src/locales/tr/index.js

@@ -0,0 +1,8 @@
+import login from './login';
+
+export default {
+  language: 'tr',
+  country: 'tr',
+  name: 'Türkçe',
+  embeddedLocale: login,
+};

client/src/locales/tr/login.js

@@ -0,0 +1,20 @@
+export default {
+  translation: {
+    common: {
+      emailOrUsername: 'E-posta adresi veya Kullanıcı adı',
+      invalidEmailOrUsername: 'Geçersiz e-posta adresi veya kullanıcı adı',
+      invalidPassword: 'Hatalı Şifre',
+      logInToPlanka: 'Giriş Yap',
+      noInternetConnection: 'Internet bağlantısı yok',
+      pageNotFound_title: 'Sayfa bulunamadı',
+      password: 'Şifre',
+      projectManagement: 'Proje Yönetimi',
+      serverConnectionFailed: 'Sunucu bağlantı hatası',
+      unknownError: 'Bilinmeyen Hata, daha sonra tekrar deneyin',
+    },
+
+    action: {
+      logIn: 'Giriş Yap',
+    },
+  },
+};

client/src/models/User.js

@@ -43,13 +43,13 @@ export default class extends BaseModel {
     organization: attr(),
     language: attr(),
     subscribeToOwnCards: attr(),
+    isAdmin: attr(),
+    isLocked: attr(),
+    isLockedAdmin: attr(),
+    deletedAt: attr(),
     createdAt: attr({
       getDefault: () => new Date(),
     }),
-    deletedAt: attr(),
-    isAdmin: attr({
-      getDefault: () => false,
-    }),
     isAvatarUpdating: attr({
       getDefault: () => false,
     }),

client/src/reducers/auth.js

@@ -10,6 +10,7 @@ const initialState = {
 export default (state = initialState, { type, payload }) => {
   switch (type) {
     case ActionTypes.AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
       return {
         ...state,
         accessToken: payload.accessToken,

client/src/reducers/core.js

@@ -4,7 +4,6 @@ import ActionTypes from '../constants/ActionTypes';
 import ModalTypes from '../constants/ModalTypes';
 
 const initialState = {
-  isInitializing: true,
   isLogouting: false,
   currentModal: null,
 };
@@ -18,11 +17,6 @@ export default (state = initialState, { type, payload }) => {
         ...state,
         currentModal: null,
       };
-    case ActionTypes.CORE_INITIALIZE:
-      return {
-        ...state,
-        isInitializing: false,
-      };
     case ActionTypes.LOGOUT__ACCESS_TOKEN_INVALIDATE:
       return {
         ...state,

client/src/reducers/index.js

@@ -3,6 +3,7 @@ import { combineReducers } from 'redux';
 import router from './router';
 import socket from './socket';
 import orm from './orm';
+import root from './root';
 import auth from './auth';
 import core from './core';
 import ui from './ui';
@@ -11,6 +12,7 @@ export default combineReducers({
   router,
   socket,
   orm,
+  root,
   auth,
   core,
   ui,

client/src/reducers/root.js

@@ -0,0 +1,34 @@
+import ActionTypes from '../constants/ActionTypes';
+
+const initialState = {
+  isInitializing: true,
+  config: null,
+};
+
+// eslint-disable-next-line default-param-last
+export default (state = initialState, { type, payload }) => {
+  switch (type) {
+    case ActionTypes.LOGIN_INITIALIZE:
+      return {
+        ...state,
+        isInitializing: false,
+        config: payload.config,
+      };
+    case ActionTypes.AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
+      return {
+        ...state,
+        isInitializing: true,
+      };
+    case ActionTypes.CORE_INITIALIZE:
+      return {
+        ...state,
+        isInitializing: false,
+        ...(payload.config && {
+          config: payload.config,
+        }),
+      };
+    default:
+      return state;
+  }
+};

client/src/reducers/ui/authenticate-form.js

@@ -1,4 +1,7 @@
+import { LOCATION_CHANGE_HANDLE } from '../../lib/redux-router';
+
 import ActionTypes from '../../constants/ActionTypes';
+import Paths from '../../constants/Paths';
 
 const initialState = {
   data: {
@@ -6,12 +9,22 @@ const initialState = {
     password: '',
   },
   isSubmitting: false,
+  isSubmittingUsingOidc: false,
   error: null,
 };
 
 // eslint-disable-next-line default-param-last
 export default (state = initialState, { type, payload }) => {
   switch (type) {
+    case LOCATION_CHANGE_HANDLE:
+      if (payload.location.pathname === Paths.OIDC_CALLBACK) {
+        return {
+          ...state,
+          isSubmittingUsingOidc: true,
+        };
+      }
+
+      return state;
     case ActionTypes.AUTHENTICATE:
       return {
         ...state,
@@ -22,6 +35,7 @@ export default (state = initialState, { type, payload }) => {
         isSubmitting: true,
       };
     case ActionTypes.AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
       return initialState;
     case ActionTypes.AUTHENTICATE__FAILURE:
       return {
@@ -29,6 +43,12 @@ export default (state = initialState, { type, payload }) => {
         isSubmitting: false,
         error: payload.error,
       };
+    case ActionTypes.USING_OIDC_AUTHENTICATE__FAILURE:
+      return {
+        ...state,
+        isSubmittingUsingOidc: false,
+        error: payload.error,
+      };
     case ActionTypes.AUTHENTICATE_ERROR_CLEAR:
       return {
         ...state,

client/src/sagas/core/index.js

@@ -1,7 +1,8 @@
-import { all, apply, fork, take } from 'redux-saga/effects';
+import { all, apply, fork, select, take } from 'redux-saga/effects';
 
 import watchers from './watchers';
 import services from './services';
+import selectors from '../../selectors';
 import { socket } from '../../api';
 import ActionTypes from '../../constants/ActionTypes';
 import Paths from '../../constants/Paths';
@@ -14,5 +15,12 @@ export default function* coreSaga() {
 
   yield take(ActionTypes.LOGOUT);
 
+  const oidcConfig = yield select(selectors.selectOidcConfig);
+
+  if (oidcConfig && oidcConfig.endSessionUrl !== null) {
+    // Redirect the user to the IDP to log out.
+    window.location.href = oidcConfig.endSessionUrl;
+  } else {
     window.location.href = Paths.LOGIN;
   }
+}

client/src/sagas/core/services/core.js

@@ -1,13 +1,21 @@
-import { call, put, take } from 'redux-saga/effects';
+import { call, put, select, take } from 'redux-saga/effects';
 
 import request from '../request';
 import requests from '../requests';
+import selectors from '../../../selectors';
 import actions from '../../../actions';
 import api from '../../../api';
 import i18n from '../../../i18n';
 import { removeAccessToken } from '../../../utils/access-token-storage';
 
 export function* initializeCore() {
+  const currentConfig = yield select(selectors.selectConfig); // TODO: add boolean selector?
+
+  let config;
+  if (!currentConfig) {
+    ({ item: config } = yield call(api.getConfig)); // TODO: handle error
+  }
+
   const {
     user,
     board,
@@ -32,6 +40,7 @@ export function* initializeCore() {
 
   yield put(
     actions.initializeCore(
+      config,
       user,
       board,
       users,

client/src/sagas/core/services/router.js

@@ -33,15 +33,16 @@ export function* handleLocationChange() {
 
   switch (pathsMatch.pattern.path) {
     case Paths.LOGIN:
+    case Paths.OIDC_CALLBACK:
       yield call(goToRoot);
 
-      break;
+      return;
     default:
   }
 
-  const isCoreInitializing = yield select(selectors.selectIsCoreInitializing);
+  const isInitializing = yield select(selectors.selectIsInitializing);
 
-  if (isCoreInitializing) {
+  if (isInitializing) {
     yield take(ActionTypes.CORE_INITIALIZE);
   }
 

client/src/sagas/core/watchers/core.js

@@ -4,8 +4,5 @@ import services from '../services';
 import EntryActionTypes from '../../../constants/EntryActionTypes';
 
 export default function* coreWatchers() {
-  yield all([
-    takeEvery(EntryActionTypes.CORE_INITIALIZE, () => services.initializeCore()),
-    takeEvery(EntryActionTypes.LOGOUT, () => services.logout()),
-  ]);
+  yield all([takeEvery(EntryActionTypes.LOGOUT, () => services.logout())]);
 }

client/src/sagas/login/index.js

@@ -7,7 +7,9 @@ import ActionTypes from '../../constants/ActionTypes';
 export default function* loginSaga() {
   const watcherTasks = yield all(watchers.map((watcher) => fork(watcher)));
 
-  yield take(ActionTypes.AUTHENTICATE__SUCCESS);
+  yield fork(services.initializeLogin);
+
+  yield take([ActionTypes.AUTHENTICATE__SUCCESS, ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS]);
 
   yield cancel(watcherTasks);
   yield call(services.goToRoot);

client/src/sagas/login/services/login.js

@@ -1,8 +1,18 @@
-import { call, put } from 'redux-saga/effects';
+import { nanoid } from 'nanoid';
+import { call, put, select } from 'redux-saga/effects';
+import { replace } from '../../../lib/redux-router';
 
+import selectors from '../../../selectors';
 import actions from '../../../actions';
 import api from '../../../api';
 import { setAccessToken } from '../../../utils/access-token-storage';
+import Paths from '../../../constants/Paths';
+
+export function* initializeLogin() {
+  const { item: config } = yield call(api.getConfig); // TODO: handle error
+
+  yield put(actions.initializeLogin(config));
+}
 
 export function* authenticate(data) {
   yield put(actions.authenticate(data));
@@ -19,11 +29,76 @@ export function* authenticate(data) {
   yield put(actions.authenticate.success(accessToken));
 }
 
+export function* authenticateUsingOidc() {
+  const oidcConfig = yield select(selectors.selectOidcConfig);
+
+  const nonce = nanoid();
+  window.sessionStorage.setItem('oidc-nonce', nonce);
+  window.location.href = `${oidcConfig.authorizationUrl}&nonce=${encodeURIComponent(nonce)}`;
+}
+
+export function* authenticateUsingOidcCallback() {
+  // https://github.com/plankanban/planka/issues/511#issuecomment-1771385639
+  const params = new URLSearchParams(window.location.hash.substring(1) || window.location.search);
+
+  yield put(replace(Paths.LOGIN));
+
+  if (params.get('error') !== null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(
+        new Error(
+          `OIDC Authorization error: ${params.get('error')}: ${params.get('error_description')}`,
+        ),
+      ),
+    );
+    return;
+  }
+
+  const nonce = window.sessionStorage.getItem('oidc-nonce');
+  if (nonce === null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(
+        new Error('Unable to process OIDC response: no nonce issued'),
+      ),
+    );
+    return;
+  }
+
+  const code = params.get('code');
+  if (code === null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(new Error('Invalid OIDC response: no code parameter')),
+    );
+    return;
+  }
+
+  window.sessionStorage.removeItem('oidc-nonce');
+
+  if (code !== null) {
+    let accessToken;
+    try {
+      ({ item: accessToken } = yield call(api.exchangeForAccessTokenUsingOidc, {
+        code,
+        nonce,
+      }));
+    } catch (error) {
+      yield put(actions.authenticateUsingOidc.failure(error));
+      return;
+    }
+
+    yield call(setAccessToken, accessToken);
+    yield put(actions.authenticateUsingOidc.success(accessToken));
+  }
+}
+
 export function* clearAuthenticateError() {
   yield put(actions.clearAuthenticateError());
 }
 
 export default {
+  initializeLogin,
   authenticate,
+  authenticateUsingOidc,
+  authenticateUsingOidcCallback,
   clearAuthenticateError,
 };

client/src/sagas/login/services/router.js

@@ -1,7 +1,9 @@
-import { call, put, select } from 'redux-saga/effects';
+import { call, put, select, take } from 'redux-saga/effects';
 import { push } from '../../../lib/redux-router';
 
+import { authenticateUsingOidcCallback } from './login';
 import selectors from '../../../selectors';
+import ActionTypes from '../../../constants/ActionTypes';
 import Paths from '../../../constants/Paths';
 
 export function* goToLogin() {
@@ -27,6 +29,17 @@ export function* handleLocationChange() {
       yield call(goToLogin);
 
       break;
+    case Paths.OIDC_CALLBACK: {
+      const isInitializing = yield select(selectors.selectIsInitializing);
+
+      if (isInitializing) {
+        yield take(ActionTypes.LOGIN_INITIALIZE);
+      }
+
+      yield call(authenticateUsingOidcCallback);
+
+      break;
+    }
     default:
   }
 }

client/src/sagas/login/watchers/login.js

@@ -8,6 +8,7 @@ export default function* loginWatchers() {
     takeEvery(EntryActionTypes.AUTHENTICATE, ({ payload: { data } }) =>
       services.authenticate(data),
     ),
+    takeEvery(EntryActionTypes.USING_OIDC_AUTHENTICATE, () => services.authenticateUsingOidc()),
     takeEvery(EntryActionTypes.AUTHENTICATE_ERROR_CLEAR, () => services.clearAuthenticateError()),
   ]);
 }

client/src/selectors/core.js

@@ -6,8 +6,6 @@ import Config from '../constants/Config';
 
 export const selectAccessToken = ({ auth: { accessToken } }) => accessToken;
 
-export const selectIsCoreInitializing = ({ core: { isInitializing } }) => isInitializing;
-
 export const selectIsLogouting = ({ core: { isLogouting } }) => isLogouting;
 
 const nextPosition = (items, index, excludedId) => {
@@ -115,7 +113,6 @@ export const selectNextTaskPosition = createSelector(
 
 export default {
   selectAccessToken,
-  selectIsCoreInitializing,
   selectIsLogouting,
   selectNextBoardPosition,
   selectNextLabelPosition,

client/src/selectors/index.js

@@ -1,5 +1,6 @@
 import router from './router';
 import socket from './socket';
+import root from './root';
 import core from './core';
 import modals from './modals';
 import users from './users';
@@ -16,6 +17,7 @@ import attachments from './attachments';
 export default {
   ...router,
   ...socket,
+  ...root,
   ...core,
   ...modals,
   ...users,

client/src/selectors/root.js

@@ -0,0 +1,11 @@
+export const selectIsInitializing = ({ root: { isInitializing } }) => isInitializing;
+
+export const selectConfig = ({ root: { config } }) => config;
+
+export const selectOidcConfig = (state) => selectConfig(state).oidc;
+
+export default {
+  selectIsInitializing,
+  selectConfig,
+  selectOidcConfig,
+};

docker-compose.yml

@@ -24,6 +24,12 @@ services:
       - DATABASE_URL=postgresql://postgres@postgres/planka
       - SECRET_KEY=notsecretkey
 
+      # Can be removed after installation
+      - DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+      - DEFAULT_ADMIN_PASSWORD=demo
+      - DEFAULT_ADMIN_NAME=Demo Demo
+      - DEFAULT_ADMIN_USERNAME=demo
+
       # related: https://github.com/knex/knex/issues/2354
       # As knex does not pass query parameters from the connection string we
       # have to use environment variables in order to pass the desired values, e.g.
@@ -31,6 +37,13 @@ services:
 
       # Configure knex to accept SSL certificates
       # - KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false
+
+      # - OIDC_ISSUER=
+      # - OIDC_CLIENT_ID=
+      # - OIDC_CLIENT_SECRET=
+      # - OIDC_SCOPES=openid email profile
+      # - OIDC_ADMIN_ROLES=admin
+      # - OIDC_ROLES_ATTRIBUTE=groups
     depends_on:
       - postgres
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "planka",
-  "version": "1.12.0",
+  "version": "1.14.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "planka",
-      "version": "1.12.0",
+      "version": "1.14.1",
       "hasInstallScript": true,
       "license": "AGPL-3.0",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "planka",
-  "version": "1.12.0",
+  "version": "1.14.1",
   "private": true,
   "homepage": "https://plankanban.github.io/planka",
   "repository": {

server/.env.sample

@@ -4,6 +4,13 @@ BASE_URL=http://localhost:1337
 DATABASE_URL=postgresql://postgres@localhost/planka
 SECRET_KEY=notsecretkey
 
+## Can be removed after installation
+
+DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+DEFAULT_ADMIN_PASSWORD=demo
+DEFAULT_ADMIN_NAME=Demo Demo
+DEFAULT_ADMIN_USERNAME=demo
+
 ## Optional
 
 # TRUST_PROXY=0
@@ -17,6 +24,13 @@ SECRET_KEY=notsecretkey
 # Configure knex to accept SSL certificates
 # KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false
 
+# OIDC_ISSUER=
+# OIDC_CLIENT_ID=
+# OIDC_CLIENT_SECRET=
+# OIDC_SCOPES=openid email profile
+# OIDC_ADMIN_ROLES=admin
+# OIDC_ROLES_ATTRIBUTE=groups
+
 ## Do not edit this
 
 TZ=UTC

server/api/controllers/access-tokens/create.js

@@ -10,6 +10,9 @@ const Errors = {
   INVALID_PASSWORD: {
     invalidPassword: 'Invalid password',
   },
+  USE_SINGLE_SIGN_ON: {
+    useSingleSignOn: 'Use single sign-on',
+  },
 };
 
 const emailOrUsernameValidator = (value) =>
@@ -37,6 +40,9 @@ module.exports = {
     invalidPassword: {
       responseType: 'unauthorized',
     },
+    useSingleSignOn: {
+      responseType: 'forbidden',
+    },
   },
 
   async fn(inputs) {
@@ -51,6 +57,10 @@ module.exports = {
       throw Errors.INVALID_EMAIL_OR_USERNAME;
     }
 
+    if (user.isSso) {
+      throw Errors.USE_SINGLE_SIGN_ON;
+    }
+
     if (!bcrypt.compareSync(inputs.password, user.password)) {
       sails.log.warn(`Invalid password! (IP: ${remoteAddress})`);
       throw Errors.INVALID_PASSWORD;

server/api/controllers/access-tokens/exchange-using-oidc.js

@@ -0,0 +1,71 @@
+const { getRemoteAddress } = require('../../../utils/remoteAddress');
+
+const Errors = {
+  INVALID_CODE_OR_NONCE: {
+    invalidCodeOrNonce: 'Invalid code or nonce',
+  },
+  EMAIL_ALREADY_IN_USE: {
+    emailAlreadyInUse: 'Email already in use',
+  },
+  USERNAME_ALREADY_IN_USE: {
+    usernameAlreadyInUse: 'Username already in use',
+  },
+  MISSING_VALUES: {
+    missingValues: 'Unable to retrieve required values (email, name)',
+  },
+};
+
+module.exports = {
+  inputs: {
+    code: {
+      type: 'string',
+      required: true,
+    },
+    nonce: {
+      type: 'string',
+      required: true,
+    },
+  },
+
+  exits: {
+    invalidCodeOrNonce: {
+      responseType: 'unauthorized',
+    },
+    emailAlreadyInUse: {
+      responseType: 'conflict',
+    },
+    usernameAlreadyInUse: {
+      responseType: 'conflict',
+    },
+    missingValues: {
+      responseType: 'unprocessableEntity',
+    },
+  },
+
+  async fn(inputs) {
+    const remoteAddress = getRemoteAddress(this.req);
+
+    const user = await sails.helpers.users
+      .getOrCreateOneUsingOidc(inputs.code, inputs.nonce)
+      .intercept('invalidCodeOrNonce', () => {
+        sails.log.warn(`Invalid code or nonce! (IP: ${remoteAddress})`);
+        return Errors.INVALID_CODE_OR_NONCE;
+      })
+      .intercept('emailAlreadyInUse', () => Errors.EMAIL_ALREADY_IN_USE)
+      .intercept('usernameAlreadyInUse', () => Errors.USERNAME_ALREADY_IN_USE)
+      .intercept('missingValues', () => Errors.MISSING_VALUES);
+
+    const accessToken = sails.helpers.utils.createToken(user.id);
+
+    await Session.create({
+      accessToken,
+      remoteAddress,
+      userId: user.id,
+      userAgent: this.req.headers['user-agent'],
+    });
+
+    return {
+      item: accessToken,
+    };
+  },
+};

server/api/controllers/show-config.js

@@ -0,0 +1,22 @@
+module.exports = {
+  fn() {
+    let oidc = null;
+    if (sails.hooks.oidc.isActive()) {
+      const oidcClient = sails.hooks.oidc.getClient();
+
+      oidc = {
+        authorizationUrl: oidcClient.authorizationUrl({
+          scope: sails.config.custom.oidcScopes,
+          response_mode: 'fragment',
+        }),
+        endSessionUrl: oidcClient.issuer.end_session_endpoint ? oidcClient.endSessionUrl({}) : null,
+      };
+    }
+
+    return {
+      item: {
+        oidc,
+      },
+    };
+  },
+};

server/api/controllers/users/delete.js

@@ -1,4 +1,7 @@
 const Errors = {
+  NOT_ENOUGH_RIGHTS: {
+    notEnoughRights: 'Not enough rights',
+  },
   USER_NOT_FOUND: {
     userNotFound: 'User not found',
   },
@@ -14,6 +17,9 @@ module.exports = {
   },
 
   exits: {
+    notEnoughRights: {
+      responseType: 'forbidden',
+    },
     userNotFound: {
       responseType: 'notFound',
     },
@@ -26,6 +32,10 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail) {
+      throw Errors.NOT_ENOUGH_RIGHTS;
+    }
+
     user = await sails.helpers.users.deleteOne.with({
       record: user,
       request: this.req,

server/api/controllers/users/update-email.js

@@ -1,6 +1,9 @@
 const bcrypt = require('bcrypt');
 
 const Errors = {
+  NOT_ENOUGH_RIGHTS: {
+    notEnoughRights: 'Not enough rights',
+  },
   USER_NOT_FOUND: {
     userNotFound: 'User not found',
   },
@@ -31,6 +34,9 @@ module.exports = {
   },
 
   exits: {
+    notEnoughRights: {
+      responseType: 'forbidden',
+    },
     userNotFound: {
       responseType: 'notFound',
     },
@@ -59,6 +65,10 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail || user.isSso) {
+      throw Errors.NOT_ENOUGH_RIGHTS;
+    }
+
     if (
       inputs.id === currentUser.id &&
       !bcrypt.compareSync(inputs.currentPassword, user.password)

server/api/controllers/users/update-password.js

@@ -4,6 +4,9 @@ const zxcvbn = require('zxcvbn');
 const { getRemoteAddress } = require('../../../utils/remoteAddress');
 
 const Errors = {
+  NOT_ENOUGH_RIGHTS: {
+    notEnoughRights: 'Not enough rights',
+  },
   USER_NOT_FOUND: {
     userNotFound: 'User not found',
   },
@@ -33,6 +36,9 @@ module.exports = {
   },
 
   exits: {
+    notEnoughRights: {
+      responseType: 'forbidden',
+    },
     userNotFound: {
       responseType: 'notFound',
     },
@@ -58,6 +64,10 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail || user.isSso) {
+      throw Errors.NOT_ENOUGH_RIGHTS;
+    }
+
     if (
       inputs.id === currentUser.id &&
       !bcrypt.compareSync(inputs.currentPassword, user.password)

server/api/controllers/users/update-username.js

@@ -1,6 +1,9 @@
 const bcrypt = require('bcrypt');
 
 const Errors = {
+  NOT_ENOUGH_RIGHTS: {
+    notEnoughRights: 'Not enough rights',
+  },
   USER_NOT_FOUND: {
     userNotFound: 'User not found',
   },
@@ -33,6 +36,9 @@ module.exports = {
   },
 
   exits: {
+    notEnoughRights: {
+      responseType: 'forbidden',
+    },
     userNotFound: {
       responseType: 'notFound',
     },
@@ -61,6 +67,10 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail || user.isSso) {
+      throw Errors.NOT_ENOUGH_RIGHTS;
+    }
+
     if (
       inputs.id === currentUser.id &&
       !bcrypt.compareSync(inputs.currentPassword, user.password)

server/api/controllers/users/update.js

@@ -67,6 +67,15 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail) {
+      /* eslint-disable no-param-reassign */
+      delete inputs.isAdmin;
+      delete inputs.name;
+      /* eslint-enable no-param-reassign */
+    } else if (user.isSso) {
+      delete inputs.name; // eslint-disable-line no-param-reassign
+    }
+
     const values = {
       ..._.pick(inputs, [
         'isAdmin',

server/api/helpers/users/create-one.js

@@ -9,7 +9,7 @@ const valuesValidator = (value) => {
     return false;
   }
 
-  if (!_.isString(value.password)) {
+  if (!_.isNil(value.password) && !_.isString(value.password)) {
     return false;
   }
 
@@ -40,6 +40,10 @@ module.exports = {
   async fn(inputs) {
     const { values } = inputs;
 
+    if (values.password) {
+      values.password = bcrypt.hashSync(values.password, 10);
+    }
+
     if (values.username) {
       values.username = values.username.toLowerCase();
     }
@@ -47,7 +51,6 @@ module.exports = {
     const user = await User.create({
       ...values,
       email: values.email.toLowerCase(),
-      password: bcrypt.hashSync(values.password, 10),
     })
       .intercept(
         {

server/api/helpers/users/delete-one.js

@@ -10,6 +10,10 @@ module.exports = {
   },
 
   async fn(inputs) {
+    await IdentityProviderUser.destroy({
+      userId: inputs.record.id,
+    });
+
     await ProjectManager.destroy({
       userId: inputs.record.id,
     });

server/api/helpers/users/get-or-create-one-using-oidc.js

@@ -0,0 +1,110 @@
+module.exports = {
+  inputs: {
+    code: {
+      type: 'string',
+      required: true,
+    },
+    nonce: {
+      type: 'string',
+      required: true,
+    },
+  },
+
+  exits: {
+    invalidCodeOrNonce: {},
+    missingValues: {},
+    emailAlreadyInUse: {},
+    usernameAlreadyInUse: {},
+  },
+
+  async fn(inputs) {
+    const client = sails.hooks.oidc.getClient();
+
+    let userInfo;
+    try {
+      const tokenSet = await client.callback(
+        sails.config.custom.oidcRedirectUri,
+        { code: inputs.code },
+        { nonce: inputs.nonce },
+      );
+      userInfo = await client.userinfo(tokenSet);
+    } catch (e) {
+      sails.log.warn(`Error while exchanging OIDC code: ${e}`);
+      throw 'invalidCodeOrNonce';
+    }
+
+    if (!userInfo.email || !userInfo.name) {
+      throw 'missingValues';
+    }
+
+    let isAdmin = false;
+    if (sails.config.custom.oidcAdminRoles.includes('*')) {
+      isAdmin = true;
+    } else {
+      const roles = userInfo[sails.config.custom.oidcRolesAttribute];
+      if (Array.isArray(roles)) {
+        // Use a Set here to avoid quadratic time complexity
+        const userRoles = new Set(userInfo[sails.config.custom.oidcRolesAttribute]);
+        isAdmin = sails.config.custom.oidcAdminRoles.findIndex((role) => userRoles.has(role)) > -1;
+      }
+    }
+
+    const values = {
+      isAdmin,
+      email: userInfo.email,
+      isSso: true,
+      name: userInfo.name,
+      username: userInfo.preferred_username,
+      subscribeToOwnCards: false,
+    };
+
+    let user;
+    // This whole block technically needs to be executed in a transaction
+    // with SERIALIZABLE isolation level (but Waterline does not support
+    // that), so this will result in errors if for example users are deleted
+    // concurrently with logging in via OIDC.
+    let identityProviderUser = await IdentityProviderUser.findOne({
+      issuer: sails.config.custom.oidcIssuer,
+      sub: userInfo.sub,
+    });
+
+    if (identityProviderUser) {
+      user = await sails.helpers.users.getOne(identityProviderUser.userId);
+    } else {
+      // If no IDP/User mapping exists, search for the user by email.
+      user = await sails.helpers.users.getOne({
+        email: values.email.toLowerCase(),
+      });
+
+      // Otherwise, create a new user.
+      if (!user) {
+        user = await sails.helpers.users
+          .createOne(values)
+          .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
+      }
+
+      identityProviderUser = await IdentityProviderUser.create({
+        userId: user.id,
+        issuer: sails.config.custom.oidcIssuer,
+        sub: userInfo.sub,
+      });
+    }
+
+    const updateFieldKeys = ['email', 'isAdmin', 'isSso', 'name', 'username'];
+
+    const updateValues = {};
+    // eslint-disable-next-line no-restricted-syntax
+    for (const k of updateFieldKeys) {
+      if (values[k] !== user[k]) updateValues[k] = values[k];
+    }
+
+    if (Object.keys(updateValues).length > 0) {
+      user = await sails.helpers.users
+        .updateOne(user, updateValues, {}) // FIXME: hack for last parameter
+        .intercept('emailAlreadyInUse', 'emailAlreadyInUse')
+        .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
+    }
+
+    return user;
+  },
+};

server/api/hooks/oidc/index.js

@@ -0,0 +1,33 @@
+const openidClient = require('openid-client');
+
+module.exports = function oidcServiceHook(sails) {
+  let client = null;
+
+  return {
+    /**
+     * Runs when this Sails app loads/lifts.
+     */
+
+    async initialize() {
+      if (sails.config.custom.oidcIssuer) {
+        const issuer = await openidClient.Issuer.discover(sails.config.custom.oidcIssuer);
+
+        client = new issuer.Client({
+          client_id: sails.config.custom.oidcClientId,
+          client_secret: sails.config.custom.oidcClientSecret,
+          redirect_uris: [sails.config.custom.oidcRedirectUri],
+          response_types: ['code'],
+        });
+        sails.log.info('OIDC hook has been loaded successfully');
+      }
+    },
+
+    getClient() {
+      return client;
+    },
+
+    isActive() {
+      return client !== null;
+    },
+  };
+};

server/api/models/IdentityProviderUser.js

@@ -0,0 +1,40 @@
+/**
+ * ProjectManager.js
+ *
+ * @description :: A model definition represents a database table/collection.
+ * @docs        :: https://sailsjs.com/docs/concepts/models-and-orm/models
+ */
+
+module.exports = {
+  attributes: {
+    issuer: {
+      type: 'string',
+      isNotEmptyString: true,
+      allowNull: true,
+    },
+    sub: {
+      type: 'string',
+      isNotEmptyString: true,
+      allowNull: true,
+    },
+    //  ╔═╗╦═╗╦╔╦╗╦╔╦╗╦╦  ╦╔═╗╔═╗
+    //  ╠═╝╠╦╝║║║║║ ║ ║╚╗╔╝║╣ ╚═╗
+    //  ╩  ╩╚═╩╩ ╩╩ ╩ ╩ ╚╝ ╚═╝╚═╝
+
+    //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
+    //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
+    //  ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
+
+    //  ╔═╗╔═╗╔═╗╔═╗╔═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+    //  ╠═╣╚═╗╚═╗║ ║║  ║╠═╣ ║ ║║ ║║║║╚═╗
+    //  ╩ ╩╚═╝╚═╝╚═╝╚═╝╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+
+    userId: {
+      model: 'User',
+      required: true,
+      columnName: 'user_id',
+    },
+  },
+
+  tableName: 'identity_provider_user',
+};

server/api/models/User.js

@@ -18,13 +18,17 @@ module.exports = {
     },
     password: {
       type: 'string',
-      required: true,
     },
     isAdmin: {
       type: 'boolean',
       defaultsTo: false,
       columnName: 'is_admin',
     },
+    isSso: {
+      type: 'boolean',
+      defaultsTo: false,
+      columnName: 'is_sso',
+    },
     name: {
       type: 'string',
       required: true,
@@ -97,13 +101,21 @@ module.exports = {
       via: 'userId',
       through: 'CardMembership',
     },
+    identityProviders: {
+      collection: 'IdentityProviderUser',
+      via: 'userId',
+    },
   },
 
   tableName: 'user_account',
 
   customToJSON() {
+    const isLockedAdmin = this.email === sails.config.custom.defaultAdminEmail;
+
     return {
-      ..._.omit(this, ['password', 'avatar', 'passwordChangedAt']),
+      ..._.omit(this, ['password', 'isSso', 'avatar', 'passwordChangedAt']),
+      isLockedAdmin,
+      isLocked: this.isSso || isLockedAdmin,
       avatarUrl:
         this.avatar &&
         `${sails.config.custom.userAvatarsUrl}/${this.avatar.dirname}/square-100.${this.avatar.extension}`,

server/config/custom.js

@@ -30,4 +30,18 @@ module.exports.custom = {
 
   attachmentsPath: path.join(sails.config.appPath, 'private', 'attachments'),
   attachmentsUrl: `${process.env.BASE_URL}/attachments`,
+
+  defaultAdminEmail: process.env.DEFAULT_ADMIN_EMAIL,
+
+  oidcIssuer: process.env.OIDC_ISSUER,
+  oidcClientId: process.env.OIDC_CLIENT_ID,
+  oidcClientSecret: process.env.OIDC_CLIENT_SECRET,
+  oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',
+  oidcAdminRoles: process.env.OIDC_ADMIN_ROLES ? process.env.OIDC_ADMIN_ROLES.split(',') : [],
+  oidcRolesAttribute: process.env.OIDC_ROLES_ATTRIBUTE || 'groups',
+
+  // TODO: move client base url to environment variable?
+  oidcRedirectUri: `${
+    sails.config.environment === 'production' ? process.env.BASE_URL : 'http://localhost:3000'
+  }/oidc-callback`,
 };

server/config/policies.js

@@ -23,5 +23,7 @@ module.exports.policies = {
 
   'projects/create': ['is-authenticated', 'is-admin'],
 
+  'show-config': true,
   'access-tokens/create': true,
+  'access-tokens/exchange-using-oidc': true,
 };

server/config/routes.js

@@ -9,7 +9,10 @@
  */
 
 module.exports.routes = {
+  'GET /api/config': 'show-config',
+
   'POST /api/access-tokens': 'access-tokens/create',
+  'POST /api/access-tokens/exchange-using-oidc': 'access-tokens/exchange-using-oidc',
   'DELETE /api/access-tokens/me': 'access-tokens/delete',
 
   'GET /api/users': 'users/index',

server/db/init.js

@@ -6,12 +6,8 @@ const knex = initKnex(knexfile);
 
 (async () => {
   try {
-    const isExists = await knex.schema.hasTable(knexfile.migrations.tableName);
-
     await knex.migrate.latest();
-    if (!isExists) {
     await knex.seed.run();
-    }
   } catch (error) {
     process.exitCode = 1;
 

server/db/migrations/20230809022050_oidc_with_pkce_flow.js

@@ -0,0 +1,44 @@
+module.exports.up = async (knex) => {
+  await knex.schema.createTable('identity_provider_user', (table) => {
+    /* Columns */
+
+    table.bigInteger('id').primary().defaultTo(knex.raw('next_id()'));
+
+    table.bigInteger('user_id').notNullable();
+
+    table.text('issuer').notNullable();
+    table.text('sub').notNullable();
+
+    table.timestamp('created_at', true);
+    table.timestamp('updated_at', true);
+
+    /* Indexes */
+
+    table.unique(['issuer', 'sub']);
+    table.index('user_id');
+  });
+
+  await knex.schema.table('user_account', (table) => {
+    /* Columns */
+
+    table.boolean('is_sso').notNullable().default(false);
+
+    /* Modifications */
+
+    table.setNullable('password');
+  });
+
+  return knex.schema.alterTable('user_account', (table) => {
+    table.boolean('is_sso').notNullable().alter();
+  });
+};
+
+module.exports.down = async (knex) => {
+  await knex.schema.dropTable('identity_provider_user');
+
+  return knex.schema.table('user_account', (table) => {
+    table.dropColumn('is_sso');
+
+    table.dropNullable('password');
+  });
+};

server/db/seeds/default.js

@@ -1,12 +1,43 @@
 const bcrypt = require('bcrypt');
 
-exports.seed = (knex) =>
-  knex('user_account').insert({
-    email: 'demo@demo.demo',
-    password: bcrypt.hashSync('demo', 10),
+const buildData = () => {
+  const data = {
     isAdmin: true,
-    name: 'Demo Demo',
-    username: 'demo',
+    isSso: false,
+  };
+
+  if (process.env.DEFAULT_ADMIN_PASSWORD) {
+    data.password = bcrypt.hashSync(process.env.DEFAULT_ADMIN_PASSWORD, 10);
+  }
+  if (process.env.DEFAULT_ADMIN_NAME) {
+    data.name = process.env.DEFAULT_ADMIN_NAME;
+  }
+  if (process.env.DEFAULT_ADMIN_USERNAME) {
+    data.username = process.env.DEFAULT_ADMIN_USERNAME;
+  }
+
+  return data;
+};
+
+exports.seed = async (knex) => {
+  if (!process.env.DEFAULT_ADMIN_EMAIL) {
+    return;
+  }
+
+  const data = buildData();
+
+  try {
+    await knex('user_account').insert({
+      ...data,
+      email: process.env.DEFAULT_ADMIN_EMAIL,
       subscribeToOwnCards: false,
       createdAt: new Date().toISOString(),
     });
+  } catch (error) {
+    if (Object.keys(data).length === 0) {
+      return;
+    }
+
+    await knex('user_account').update(data).where('email', process.env.DEFAULT_ADMIN_EMAIL);
+  }
+};

server/package-lock.json

@@ -15,8 +15,9 @@
         "lodash": "^4.17.21",
         "moment": "^2.29.4",
         "move-file": "^2.1.0",
+        "openid-client": "^5.4.3",
         "rimraf": "^3.0.2",
-        "sails": "^1.5.3",
+        "sails": "^1.5.7",
         "sails-hook-orm": "^4.0.2",
         "sails-hook-sockets": "^2.0.3",
         "sails-postgresql-redacted": "^1.0.2-9",
@@ -554,29 +555,29 @@
       "integrity": "sha512-OfdwXncy2KqoGIlXUqxe+xb7G54s8y5pdo96+KGQMkQMZ5C/rT26tT2IJxWtgiAPeklwAU6iXxxjX8b8blcTPQ=="
     },
     "node_modules/body-parser": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.0.tgz",
-      "integrity": "sha512-dhEPs72UPbDnAQJ9ZKMNTP6ptJaionhP5cBb541nXPlW60Jepo9RV/a4fX4XWW9CuFNK22krhrj1+rgzifNCsw==",
+      "version": "1.19.2",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.2.tgz",
+      "integrity": "sha512-SAAwOxgoCKMGs9uUAUFHygfLAyaniaoun6I8mFY9pRAJL9+Kec34aU+oIjDhTycub1jozEfEwx1W1IuOYxVSFw==",
       "dependencies": {
-        "bytes": "3.1.0",
+        "bytes": "3.1.2",
         "content-type": "~1.0.4",
         "debug": "2.6.9",
         "depd": "~1.1.2",
-        "http-errors": "1.7.2",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "on-finished": "~2.3.0",
-        "qs": "6.7.0",
-        "raw-body": "2.4.0",
-        "type-is": "~1.6.17"
+        "qs": "6.9.7",
+        "raw-body": "2.4.3",
+        "type-is": "~1.6.18"
       },
       "engines": {
         "node": ">= 0.8"
       }
     },
     "node_modules/body-parser/node_modules/bytes": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-      "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "engines": {
         "node": ">= 0.8"
       }
@@ -590,30 +591,38 @@
       }
     },
     "node_modules/body-parser/node_modules/http-errors": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
-      "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
       "dependencies": {
         "depd": "~1.1.2",
-        "inherits": "2.0.3",
-        "setprototypeof": "1.1.1",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
         "statuses": ">= 1.5.0 < 2",
-        "toidentifier": "1.0.0"
+        "toidentifier": "1.0.1"
       },
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/body-parser/node_modules/inherits": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-      "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw=="
-    },
     "node_modules/body-parser/node_modules/ms": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
     },
+    "node_modules/body-parser/node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+    },
+    "node_modules/body-parser/node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
     "node_modules/brace-expansion": {
       "version": "1.1.11",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
@@ -1115,21 +1124,16 @@
       "integrity": "sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ=="
     },
     "node_modules/content-disposition": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.3.tgz",
-      "integrity": "sha512-ExO0774ikEObIAEV9kDo50o+79VCUdEB6n6lzKgGwupcVeRlhrj3qGAfwq8G6uBJjkqLrhT0qEYFcWng8z1z0g==",
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
       "dependencies": {
-        "safe-buffer": "5.1.2"
+        "safe-buffer": "5.2.1"
       },
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/content-disposition/node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-    },
     "node_modules/content-type": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.4.tgz",
@@ -2067,16 +2071,16 @@
       }
     },
     "node_modules/express": {
-      "version": "4.17.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
-      "integrity": "sha512-mHJ9O79RqluphRrcw2X/GTh3k9tVv8YcoyY4Kkh4WDMUYKRZUq0h1o0w2rrrxBqM7VoeUVqgb27xlEMXTnYt4g==",
+      "version": "4.17.3",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.17.3.tgz",
+      "integrity": "sha512-yuSQpz5I+Ch7gFrPCk4/c+dIBKlQUxtgwqzph132bsT6qhuzss6I8cLJQz7B3rFblzd6wtcI0ZbGltH/C4LjUg==",
       "dependencies": {
-        "accepts": "~1.3.7",
+        "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.19.0",
-        "content-disposition": "0.5.3",
+        "body-parser": "1.19.2",
+        "content-disposition": "0.5.4",
         "content-type": "~1.0.4",
-        "cookie": "0.4.0",
+        "cookie": "0.4.2",
         "cookie-signature": "1.0.6",
         "debug": "2.6.9",
         "depd": "~1.1.2",
@@ -2090,13 +2094,13 @@
         "on-finished": "~2.3.0",
         "parseurl": "~1.3.3",
         "path-to-regexp": "0.1.7",
-        "proxy-addr": "~2.0.5",
-        "qs": "6.7.0",
+        "proxy-addr": "~2.0.7",
+        "qs": "6.9.7",
         "range-parser": "~1.2.1",
-        "safe-buffer": "5.1.2",
-        "send": "0.17.1",
-        "serve-static": "1.14.1",
-        "setprototypeof": "1.1.1",
+        "safe-buffer": "5.2.1",
+        "send": "0.17.2",
+        "serve-static": "1.14.2",
+        "setprototypeof": "1.2.0",
         "statuses": "~1.5.0",
         "type-is": "~1.6.18",
         "utils-merge": "1.0.1",
@@ -2163,6 +2167,14 @@
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.0.tgz",
       "integrity": "sha512-fZEwUGbVl7kouZs1jCdMLdt95hdIv0ZeHg6L7qPeciMZhZ+/gdesW4wgTARkrFWEpspjEATAzUGPG8N2jJiwbg=="
     },
+    "node_modules/express/node_modules/cookie": {
+      "version": "0.4.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.2.tgz",
+      "integrity": "sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA==",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/express/node_modules/cookie-signature": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
@@ -2211,25 +2223,25 @@
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
       "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ=="
     },
-    "node_modules/express/node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-    },
     "node_modules/express/node_modules/serve-static": {
-      "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.1.tgz",
-      "integrity": "sha512-JMrvUwE54emCYWlTI+hGrGv5I8dEwmco/00EvkzIIsR7MqrHonbD9pO2MOfFnpFntl7ecpZs+3mW+XbQZu9QCg==",
+      "version": "1.14.2",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.2.tgz",
+      "integrity": "sha512-+TMNA9AFxUEGuC0z2mevogSnn9MXKb4fa7ngeRMJaaGv8vTwnIEkKi+QGvPt33HSnf8pRS+WGM0EbMtCJLKMBQ==",
       "dependencies": {
         "encodeurl": "~1.0.2",
         "escape-html": "~1.0.3",
         "parseurl": "~1.3.3",
-        "send": "0.17.1"
+        "send": "0.17.2"
       },
       "engines": {
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/express/node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+    },
     "node_modules/extend": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
@@ -3634,6 +3646,14 @@
       "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz",
       "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ=="
     },
+    "node_modules/jose": {
+      "version": "4.14.4",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-4.14.4.tgz",
+      "integrity": "sha512-j8GhLiKmUAh+dsFXlX1aJCbt5KMibuKb+d7j1JaOJG6s2UjX1PQlW+OKB/sD4a/5ZYF4RcmYmLSndOoU3Lt/3g==",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/js-sdsl": {
       "version": "4.1.5",
       "resolved": "https://registry.npmjs.org/js-sdsl/-/js-sdsl-4.1.5.tgz",
@@ -4546,6 +4566,14 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/object-hash": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-2.2.0.tgz",
+      "integrity": "sha512-gScRMn0bS5fH+IuwyIFgnh9zBdo4DV+6GhygmWM9HyNJSgS0hScp1f5vjtm7oIIOiT9trXrShAkLFSc2IqKNgw==",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/object-inspect": {
       "version": "1.12.2",
       "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.2.tgz",
@@ -4625,6 +4653,14 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/oidc-token-hash": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.0.3.tgz",
+      "integrity": "sha512-IF4PcGgzAr6XXSff26Sk/+P4KZFJVuHAJZj3wgO3vX2bMdNVp/QXTP3P7CEm9V1IdG8lDLY3HhiqpsE/nOwpPw==",
+      "engines": {
+        "node": "^10.13.0 || >=12.0.0"
+      }
+    },
     "node_modules/on-finished": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
@@ -4660,6 +4696,20 @@
         "fn.name": "1.x.x"
       }
     },
+    "node_modules/openid-client": {
+      "version": "5.4.3",
+      "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-5.4.3.tgz",
+      "integrity": "sha512-sVQOvjsT/sbSfYsQI/9liWQGVZH/Pp3rrtlGEwgk/bbHfrUDZ24DN57lAagIwFtuEu+FM9Ev7r85s8S/yPjimQ==",
+      "dependencies": {
+        "jose": "^4.14.4",
+        "lru-cache": "^6.0.0",
+        "object-hash": "^2.2.0",
+        "oidc-token-hash": "^5.0.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/opn": {
       "version": "5.3.0",
       "resolved": "https://registry.npmjs.org/opn/-/opn-5.3.0.tgz",
@@ -5138,11 +5188,14 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.7.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
-      "integrity": "sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ==",
+      "version": "6.9.7",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.9.7.tgz",
+      "integrity": "sha512-IhMFgUmuNpyRfxA90umL7ByLlgRXu6tIfKPpF5TmcfRLlLCckfP/g3IQmju6jjpu+Hh8rA+2p6A27ZSPOOHdKw==",
       "engines": {
         "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
     "node_modules/queue-microtask": {
@@ -5220,12 +5273,12 @@
       }
     },
     "node_modules/raw-body": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.0.tgz",
-      "integrity": "sha512-4Oz8DUIwdvoa5qMJelxipzi/iJIi40O5cGV1wNYp5hvZP8ZN0T+jiNkL0QepXs+EsQ9XJ8ipEDoiH70ySUJP3Q==",
+      "version": "2.4.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.3.tgz",
+      "integrity": "sha512-UlTNLIcu0uzb4D2f4WltY6cVjLi+/jEN4lgEUj3E04tpMDpUlkBo/eSn6zou9hum2VMNpCCUone0O0WeJim07g==",
       "dependencies": {
-        "bytes": "3.1.0",
-        "http-errors": "1.7.2",
+        "bytes": "3.1.2",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "unpipe": "1.0.0"
       },
@@ -5234,32 +5287,40 @@
       }
     },
     "node_modules/raw-body/node_modules/bytes": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-      "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "engines": {
         "node": ">= 0.8"
       }
     },
     "node_modules/raw-body/node_modules/http-errors": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
-      "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
       "dependencies": {
         "depd": "~1.1.2",
-        "inherits": "2.0.3",
-        "setprototypeof": "1.1.1",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
         "statuses": ">= 1.5.0 < 2",
-        "toidentifier": "1.0.0"
+        "toidentifier": "1.0.1"
       },
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/raw-body/node_modules/inherits": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-      "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw=="
+    "node_modules/raw-body/node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+    },
+    "node_modules/raw-body/node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "engines": {
+        "node": ">=0.6"
+      }
     },
     "node_modules/rc": {
       "version": "1.2.8",
@@ -5657,9 +5718,9 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
     },
     "node_modules/sails": {
-      "version": "1.5.3",
-      "resolved": "https://registry.npmjs.org/sails/-/sails-1.5.3.tgz",
-      "integrity": "sha512-JH9kKEtkBnb3NRNe7wMgbrlCpwIymiqMvFN8nG3S77gXBqnEGh2JMrmoiwLhRsK05Lisze8YvZ4ip27e7xoWHA==",
+      "version": "1.5.8",
+      "resolved": "https://registry.npmjs.org/sails/-/sails-1.5.8.tgz",
+      "integrity": "sha512-S1omXwRYsnJzQtnDG0pDOmLUT8WssFV3KMIE15grYo6gtOwUwPhITs8dSw1rzTCyV8TIt5vQzVbeL82vvfwINA==",
       "dependencies": {
         "@sailshq/lodash": "^3.10.2",
         "async": "2.6.4",
@@ -5674,7 +5735,7 @@
         "cookie-signature": "1.1.0",
         "csurf": "1.10.0",
         "ejs": "3.1.7",
-        "express": "4.17.1",
+        "express": "4.17.3",
         "express-session": "1.17.0",
         "flaverr": "^1.10.0",
         "glob": "7.1.2",
@@ -5697,7 +5758,7 @@
         "rttc": "^10.0.0-0",
         "sails-generate": "^2.0.3",
         "sails-stringfile": "^0.3.3",
-        "semver": "4.3.6",
+        "semver": "7.5.2",
         "serve-favicon": "2.4.5",
         "serve-static": "1.13.1",
         "skipper": "^0.9.0-0",
@@ -6073,14 +6134,6 @@
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
       "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q=="
     },
-    "node_modules/sails/node_modules/semver": {
-      "version": "4.3.6",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-4.3.6.tgz",
-      "integrity": "sha512-IrpJ+yoG4EOH8DFWuVg+8H1kW1Oaof0Wxe7cPcXW3x9BjkN/eVo54F15LyqemnDIUYskQWr9qvl/RihmSy6+xQ==",
-      "bin": {
-        "semver": "bin/semver"
-      }
-    },
     "node_modules/sails/node_modules/supports-color": {
       "version": "4.5.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-4.5.0.tgz",
@@ -6093,9 +6146,9 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.3.8",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-      "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
+      "version": "7.5.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.2.tgz",
+      "integrity": "sha512-SoftuTROv/cRjCze/scjGyiDtcUyxw1rgYQSZY7XTmtR5hX+dm76iDbTH8TkLPHCQmlbQVSSbNZCPM2hb0knnQ==",
       "dependencies": {
         "lru-cache": "^6.0.0"
       },
@@ -6107,9 +6160,9 @@
       }
     },
     "node_modules/send": {
-      "version": "0.17.1",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.17.1.tgz",
-      "integrity": "sha512-BsVKsiGcQMFwT8UxypobUKyv7irCNRHk1T0G680vk88yf6LBByGcZJOTJCrTP2xVN6yI+XjPJcNuE3V4fT9sAg==",
+      "version": "0.17.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.17.2.tgz",
+      "integrity": "sha512-UJYB6wFSJE3G00nEivR5rgWp8c2xXvJ3OPWPhmuteU0IKj8nKbG3DrjiOmLwpnHGYWAVwA69zmTm++YG0Hmwww==",
       "dependencies": {
         "debug": "2.6.9",
         "depd": "~1.1.2",
@@ -6118,9 +6171,9 @@
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
         "fresh": "0.5.2",
-        "http-errors": "~1.7.2",
+        "http-errors": "1.8.1",
         "mime": "1.6.0",
-        "ms": "2.1.1",
+        "ms": "2.1.3",
         "on-finished": "~2.3.0",
         "range-parser": "~1.2.1",
         "statuses": "~1.5.0"
@@ -6142,10 +6195,38 @@
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
     },
+    "node_modules/send/node_modules/http-errors": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
+      "dependencies": {
+        "depd": "~1.1.2",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
+        "statuses": ">= 1.5.0 < 2",
+        "toidentifier": "1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/send/node_modules/ms": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.1.tgz",
-      "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg=="
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+    },
+    "node_modules/send/node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+    },
+    "node_modules/send/node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "engines": {
+        "node": ">=0.6"
+      }
     },
     "node_modules/serialize-javascript": {
       "version": "6.0.0",
@@ -8308,26 +8389,26 @@
       "integrity": "sha512-OfdwXncy2KqoGIlXUqxe+xb7G54s8y5pdo96+KGQMkQMZ5C/rT26tT2IJxWtgiAPeklwAU6iXxxjX8b8blcTPQ=="
     },
     "body-parser": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.0.tgz",
-      "integrity": "sha512-dhEPs72UPbDnAQJ9ZKMNTP6ptJaionhP5cBb541nXPlW60Jepo9RV/a4fX4XWW9CuFNK22krhrj1+rgzifNCsw==",
+      "version": "1.19.2",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.2.tgz",
+      "integrity": "sha512-SAAwOxgoCKMGs9uUAUFHygfLAyaniaoun6I8mFY9pRAJL9+Kec34aU+oIjDhTycub1jozEfEwx1W1IuOYxVSFw==",
       "requires": {
-        "bytes": "3.1.0",
+        "bytes": "3.1.2",
         "content-type": "~1.0.4",
         "debug": "2.6.9",
         "depd": "~1.1.2",
-        "http-errors": "1.7.2",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "on-finished": "~2.3.0",
-        "qs": "6.7.0",
-        "raw-body": "2.4.0",
-        "type-is": "~1.6.17"
+        "qs": "6.9.7",
+        "raw-body": "2.4.3",
+        "type-is": "~1.6.18"
       },
       "dependencies": {
         "bytes": {
-          "version": "3.1.0",
-          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-          "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg=="
+          "version": "3.1.2",
+          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+          "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="
         },
         "debug": {
           "version": "2.6.9",
@@ -8338,26 +8419,31 @@
           }
         },
         "http-errors": {
-          "version": "1.7.2",
-          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
-          "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+          "version": "1.8.1",
+          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+          "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
           "requires": {
             "depd": "~1.1.2",
-            "inherits": "2.0.3",
-            "setprototypeof": "1.1.1",
+            "inherits": "2.0.4",
+            "setprototypeof": "1.2.0",
             "statuses": ">= 1.5.0 < 2",
-            "toidentifier": "1.0.0"
+            "toidentifier": "1.0.1"
           }
         },
-        "inherits": {
-          "version": "2.0.3",
-          "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-          "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw=="
-        },
         "ms": {
           "version": "2.0.0",
           "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
           "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+        },
+        "setprototypeof": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+          "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+        },
+        "toidentifier": {
+          "version": "1.0.1",
+          "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+          "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="
         }
       }
     },
@@ -8760,18 +8846,11 @@
       "integrity": "sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ=="
     },
     "content-disposition": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.3.tgz",
-      "integrity": "sha512-ExO0774ikEObIAEV9kDo50o+79VCUdEB6n6lzKgGwupcVeRlhrj3qGAfwq8G6uBJjkqLrhT0qEYFcWng8z1z0g==",
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
       "requires": {
-        "safe-buffer": "5.1.2"
-      },
-      "dependencies": {
-        "safe-buffer": {
-          "version": "5.1.2",
-          "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-          "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-        }
+        "safe-buffer": "5.2.1"
       }
     },
     "content-type": {
@@ -9503,16 +9582,16 @@
       }
     },
     "express": {
-      "version": "4.17.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
-      "integrity": "sha512-mHJ9O79RqluphRrcw2X/GTh3k9tVv8YcoyY4Kkh4WDMUYKRZUq0h1o0w2rrrxBqM7VoeUVqgb27xlEMXTnYt4g==",
+      "version": "4.17.3",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.17.3.tgz",
+      "integrity": "sha512-yuSQpz5I+Ch7gFrPCk4/c+dIBKlQUxtgwqzph132bsT6qhuzss6I8cLJQz7B3rFblzd6wtcI0ZbGltH/C4LjUg==",
       "requires": {
-        "accepts": "~1.3.7",
+        "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.19.0",
-        "content-disposition": "0.5.3",
+        "body-parser": "1.19.2",
+        "content-disposition": "0.5.4",
         "content-type": "~1.0.4",
-        "cookie": "0.4.0",
+        "cookie": "0.4.2",
         "cookie-signature": "1.0.6",
         "debug": "2.6.9",
         "depd": "~1.1.2",
@@ -9526,19 +9605,24 @@
         "on-finished": "~2.3.0",
         "parseurl": "~1.3.3",
         "path-to-regexp": "0.1.7",
-        "proxy-addr": "~2.0.5",
-        "qs": "6.7.0",
+        "proxy-addr": "~2.0.7",
+        "qs": "6.9.7",
         "range-parser": "~1.2.1",
-        "safe-buffer": "5.1.2",
-        "send": "0.17.1",
-        "serve-static": "1.14.1",
-        "setprototypeof": "1.1.1",
+        "safe-buffer": "5.2.1",
+        "send": "0.17.2",
+        "serve-static": "1.14.2",
+        "setprototypeof": "1.2.0",
         "statuses": "~1.5.0",
         "type-is": "~1.6.18",
         "utils-merge": "1.0.1",
         "vary": "~1.1.2"
       },
       "dependencies": {
+        "cookie": {
+          "version": "0.4.2",
+          "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.2.tgz",
+          "integrity": "sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA=="
+        },
         "cookie-signature": {
           "version": "1.0.6",
           "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
@@ -9581,21 +9665,21 @@
           "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
           "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ=="
         },
-        "safe-buffer": {
-          "version": "5.1.2",
-          "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-          "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-        },
         "serve-static": {
-          "version": "1.14.1",
-          "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.1.tgz",
-          "integrity": "sha512-JMrvUwE54emCYWlTI+hGrGv5I8dEwmco/00EvkzIIsR7MqrHonbD9pO2MOfFnpFntl7ecpZs+3mW+XbQZu9QCg==",
+          "version": "1.14.2",
+          "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.2.tgz",
+          "integrity": "sha512-+TMNA9AFxUEGuC0z2mevogSnn9MXKb4fa7ngeRMJaaGv8vTwnIEkKi+QGvPt33HSnf8pRS+WGM0EbMtCJLKMBQ==",
           "requires": {
             "encodeurl": "~1.0.2",
             "escape-html": "~1.0.3",
             "parseurl": "~1.3.3",
-            "send": "0.17.1"
+            "send": "0.17.2"
           }
+        },
+        "setprototypeof": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+          "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
         }
       }
     },
@@ -10706,6 +10790,11 @@
         }
       }
     },
+    "jose": {
+      "version": "4.14.4",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-4.14.4.tgz",
+      "integrity": "sha512-j8GhLiKmUAh+dsFXlX1aJCbt5KMibuKb+d7j1JaOJG6s2UjX1PQlW+OKB/sD4a/5ZYF4RcmYmLSndOoU3Lt/3g=="
+    },
     "js-sdsl": {
       "version": "4.1.5",
       "resolved": "https://registry.npmjs.org/js-sdsl/-/js-sdsl-4.1.5.tgz",
@@ -11406,6 +11495,11 @@
       "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
       "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="
     },
+    "object-hash": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-2.2.0.tgz",
+      "integrity": "sha512-gScRMn0bS5fH+IuwyIFgnh9zBdo4DV+6GhygmWM9HyNJSgS0hScp1f5vjtm7oIIOiT9trXrShAkLFSc2IqKNgw=="
+    },
     "object-inspect": {
       "version": "1.12.2",
       "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.2.tgz",
@@ -11461,6 +11555,11 @@
         "es-abstract": "^1.20.4"
       }
     },
+    "oidc-token-hash": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.0.3.tgz",
+      "integrity": "sha512-IF4PcGgzAr6XXSff26Sk/+P4KZFJVuHAJZj3wgO3vX2bMdNVp/QXTP3P7CEm9V1IdG8lDLY3HhiqpsE/nOwpPw=="
+    },
     "on-finished": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
@@ -11490,6 +11589,17 @@
         "fn.name": "1.x.x"
       }
     },
+    "openid-client": {
+      "version": "5.4.3",
+      "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-5.4.3.tgz",
+      "integrity": "sha512-sVQOvjsT/sbSfYsQI/9liWQGVZH/Pp3rrtlGEwgk/bbHfrUDZ24DN57lAagIwFtuEu+FM9Ev7r85s8S/yPjimQ==",
+      "requires": {
+        "jose": "^4.14.4",
+        "lru-cache": "^6.0.0",
+        "object-hash": "^2.2.0",
+        "oidc-token-hash": "^5.0.3"
+      }
+    },
     "opn": {
       "version": "5.3.0",
       "resolved": "https://registry.npmjs.org/opn/-/opn-5.3.0.tgz",
@@ -11859,9 +11969,9 @@
       "dev": true
     },
     "qs": {
-      "version": "6.7.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
-      "integrity": "sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ=="
+      "version": "6.9.7",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.9.7.tgz",
+      "integrity": "sha512-IhMFgUmuNpyRfxA90umL7ByLlgRXu6tIfKPpF5TmcfRLlLCckfP/g3IQmju6jjpu+Hh8rA+2p6A27ZSPOOHdKw=="
     },
     "queue-microtask": {
       "version": "1.2.3",
@@ -11911,37 +12021,42 @@
       "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="
     },
     "raw-body": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.0.tgz",
-      "integrity": "sha512-4Oz8DUIwdvoa5qMJelxipzi/iJIi40O5cGV1wNYp5hvZP8ZN0T+jiNkL0QepXs+EsQ9XJ8ipEDoiH70ySUJP3Q==",
+      "version": "2.4.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.3.tgz",
+      "integrity": "sha512-UlTNLIcu0uzb4D2f4WltY6cVjLi+/jEN4lgEUj3E04tpMDpUlkBo/eSn6zou9hum2VMNpCCUone0O0WeJim07g==",
       "requires": {
-        "bytes": "3.1.0",
-        "http-errors": "1.7.2",
+        "bytes": "3.1.2",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "unpipe": "1.0.0"
       },
       "dependencies": {
         "bytes": {
-          "version": "3.1.0",
-          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-          "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg=="
+          "version": "3.1.2",
+          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+          "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="
         },
         "http-errors": {
-          "version": "1.7.2",
-          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
-          "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+          "version": "1.8.1",
+          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+          "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
           "requires": {
             "depd": "~1.1.2",
-            "inherits": "2.0.3",
-            "setprototypeof": "1.1.1",
+            "inherits": "2.0.4",
+            "setprototypeof": "1.2.0",
             "statuses": ">= 1.5.0 < 2",
-            "toidentifier": "1.0.0"
+            "toidentifier": "1.0.1"
           }
         },
-        "inherits": {
-          "version": "2.0.3",
-          "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-          "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw=="
+        "setprototypeof": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+          "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+        },
+        "toidentifier": {
+          "version": "1.0.1",
+          "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+          "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="
         }
       }
     },
@@ -12224,9 +12339,9 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
     },
     "sails": {
-      "version": "1.5.3",
-      "resolved": "https://registry.npmjs.org/sails/-/sails-1.5.3.tgz",
-      "integrity": "sha512-JH9kKEtkBnb3NRNe7wMgbrlCpwIymiqMvFN8nG3S77gXBqnEGh2JMrmoiwLhRsK05Lisze8YvZ4ip27e7xoWHA==",
+      "version": "1.5.8",
+      "resolved": "https://registry.npmjs.org/sails/-/sails-1.5.8.tgz",
+      "integrity": "sha512-S1omXwRYsnJzQtnDG0pDOmLUT8WssFV3KMIE15grYo6gtOwUwPhITs8dSw1rzTCyV8TIt5vQzVbeL82vvfwINA==",
       "requires": {
         "@sailshq/lodash": "^3.10.2",
         "async": "2.6.4",
@@ -12241,7 +12356,7 @@
         "cookie-signature": "1.1.0",
         "csurf": "1.10.0",
         "ejs": "3.1.7",
-        "express": "4.17.1",
+        "express": "4.17.3",
         "express-session": "1.17.0",
         "flaverr": "^1.10.0",
         "glob": "7.1.2",
@@ -12264,7 +12379,7 @@
         "rttc": "^10.0.0-0",
         "sails-generate": "^2.0.3",
         "sails-stringfile": "^0.3.3",
-        "semver": "4.3.6",
+        "semver": "7.5.2",
         "serve-favicon": "2.4.5",
         "serve-static": "1.13.1",
         "skipper": "^0.9.0-0",
@@ -12338,11 +12453,6 @@
           "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
           "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q=="
         },
-        "semver": {
-          "version": "4.3.6",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-4.3.6.tgz",
-          "integrity": "sha512-IrpJ+yoG4EOH8DFWuVg+8H1kW1Oaof0Wxe7cPcXW3x9BjkN/eVo54F15LyqemnDIUYskQWr9qvl/RihmSy6+xQ=="
-        },
         "supports-color": {
           "version": "4.5.0",
           "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-4.5.0.tgz",
@@ -12591,17 +12701,17 @@
       "integrity": "sha512-fBMdntawlqd5N/1xL9Vu6l+J5zvy86jLUf0nFDal5McUeZzUy7PpNqq+Vx/F9KgItAyFJ7RoO3YltO9dD0Q5OQ=="
     },
     "semver": {
-      "version": "7.3.8",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-      "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
+      "version": "7.5.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.2.tgz",
+      "integrity": "sha512-SoftuTROv/cRjCze/scjGyiDtcUyxw1rgYQSZY7XTmtR5hX+dm76iDbTH8TkLPHCQmlbQVSSbNZCPM2hb0knnQ==",
       "requires": {
         "lru-cache": "^6.0.0"
       }
     },
     "send": {
-      "version": "0.17.1",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.17.1.tgz",
-      "integrity": "sha512-BsVKsiGcQMFwT8UxypobUKyv7irCNRHk1T0G680vk88yf6LBByGcZJOTJCrTP2xVN6yI+XjPJcNuE3V4fT9sAg==",
+      "version": "0.17.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.17.2.tgz",
+      "integrity": "sha512-UJYB6wFSJE3G00nEivR5rgWp8c2xXvJ3OPWPhmuteU0IKj8nKbG3DrjiOmLwpnHGYWAVwA69zmTm++YG0Hmwww==",
       "requires": {
         "debug": "2.6.9",
         "depd": "~1.1.2",
@@ -12610,9 +12720,9 @@
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
         "fresh": "0.5.2",
-        "http-errors": "~1.7.2",
+        "http-errors": "1.8.1",
         "mime": "1.6.0",
-        "ms": "2.1.1",
+        "ms": "2.1.3",
         "on-finished": "~2.3.0",
         "range-parser": "~1.2.1",
         "statuses": "~1.5.0"
@@ -12633,10 +12743,32 @@
             }
           }
         },
+        "http-errors": {
+          "version": "1.8.1",
+          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+          "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
+          "requires": {
+            "depd": "~1.1.2",
+            "inherits": "2.0.4",
+            "setprototypeof": "1.2.0",
+            "statuses": ">= 1.5.0 < 2",
+            "toidentifier": "1.0.1"
+          }
+        },
         "ms": {
-          "version": "2.1.1",
-          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.1.tgz",
-          "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg=="
+          "version": "2.1.3",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+          "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+        },
+        "setprototypeof": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+          "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+        },
+        "toidentifier": {
+          "version": "1.0.1",
+          "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+          "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="
         }
       }
     },

server/package.json

@@ -36,8 +36,9 @@
     "lodash": "^4.17.21",
     "moment": "^2.29.4",
     "move-file": "^2.1.0",
+    "openid-client": "^5.4.3",
     "rimraf": "^3.0.2",
-    "sails": "^1.5.3",
+    "sails": "^1.5.7",
     "sails-hook-orm": "^4.0.2",
     "sails-hook-sockets": "^2.0.3",
     "sails-postgresql-redacted": "^1.0.2-9",